CVEs we hold for Yaycommerce
Records whose assigning authority named Yaycommerce as the affected vendor. Newest identifiers first, capped at 200.
CVE-2026-66442WordPress YayPricing plugin <= 3.5.6 - Broken Access Control vulnerabilityYayCommerce YayPricing
CVE-2026-27327WordPress YayMail – WooCommerce Email Customizer plugin <= 4.3.2 - Broken Access Control vulnerabilityYayCommerce YayMail
CVE-2026-1943YayMail <= 4.3.2 - Authenticated (Shop Manager+) Stored Cross-Site Scripting via Template Elementsyaycommerce YayMail – WooCommerce Email Customizer
CVE-2026-1938YayMail <= 4.3.2 - Missing Authorization to Authenticated (Shop Manager+) License Key Deletion via…yaycommerce YayMail – WooCommerce Email Customizer
CVE-2026-1937YayMail <= 4.3.2 - Missing Authorization to Authenticated (Shop Manager+) Arbitrary Options Update via…yaycommerce YayMail – WooCommerce Email Customizer
CVE-2026-1831YayMail <= 4.3.2 - Missing Authorization to Authenticated (Shop Manager+) Plugin Installation and Activationyaycommerce YayMail – WooCommerce Email Customizer
CVE-2025-67994WordPress YayCurrency plugin <= 3.3 - Arbitrary Content Deletion vulnerabilityYayCommerce YayCurrency
CVE-2025-60114WordPress YayCurrency plugin <= 3.3.1 - Remote Code Execution (RCE) vulnerabilityYayCommerce YayCurrency
CVE-2025-60077WordPress YayPricing plugin <= 3.5.3 - Broken Access Control vulnerabilityYayCommerce YayPricing
CVE-2025-54043WordPress SMTP for Amazon SES plugin <= 1.9 - SQL Injection VulnerabilityYayCommerce SMTP for Amazon SES
CVE-2025-48301WordPress SMTP for SendGrid – YaySMTP plugin <= 1.5 - SQL Injection VulnerabilityYayCommerce SMTP for SendGrid – YaySMTP
CVE-2025-3434SMTP for Amazon SES – YaySMTP <= 1.8 - Unauthenticated Stored Cross-Site Scripting via Email Logsyaycommerce SMTP for Amazon SES – YaySMTP
CVE-2025-0957Vulnerability: SMTP for Amazon SES <= 1.8 - Unauthenticated Stored Cross-Site Scripting via Email Logsyaycommerce SMTP for Amazon SES – YaySMTP
CVE-2025-0953SMTP for Sendinblue – YaySMTP <= 1.2 - Unauthenticated Stored Cross-Site Scripting via Email Logsyaycommerce SMTP for Sendinblue – YaySMTP
CVE-2025-0918SMTP for SendGrid – YaySMTP <= 1.4 - Unauthenticated Stored Cross-Site Scripting via Email Logsyaycommerce SMTP for SendGrid – YaySMTP
CVE-2025-0916YaySMTP 2.4.9 - 2.6.2 - Unauthenticated Stored Cross-Site Scriptingyaycommerce YaySMTP and Email Logs: Amazon SES, SendGrid…
CVE-2024-7257YayExtra – WooCommerce Extra Product Options <= 1.3.7 - Unauthenticated Arbitrary File Upload via handle_upload_file…yaycommerce YayExtra – WooCommerce Extra Product Options
CVE-2024-54348WordPress Brandy theme <= 1.1.6 - Cross Site Scripting (XSS) vulnerabilityyaycommerce Brand
CVE-2023-3093YaySMTP <= 2.4.5 - Unauthenticated Stored Cross-Site Scripting via Emailyaycommerce YaySMTP and Email Logs: Amazon SES, SendGrid…
25 records, read from the index as it stood on 20 Sep 2026. Every row opens the record it names, and every value on that record opens its own receipt.
Everything on this page is free. Public data. Withholding it protects nothing.