YayMail vulnerabilities | LiveThreat CVE Feed

Product

YayMail

by YayCommerce · last CVE Oct 29, 2026

CVEs

On KEV

7.6

Max CVSS

New 30D

Severity mix

Critical 0High 2Medium 1Low 0

Severity

Exploitation

Watch

Add YayMail to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2026-39496	7.6	0%	Apr 8	WordPress YayMail plugin <= 4.3.3 - SQL Injection vulnerability Affected: through 4.3.3
CVE-2026-42701 New	7.2	–	Oct 29	WordPress YayMail plugin <= 4.4.6 - PHP Object Injection vulnerability Affected: through 4.4.6
CVE-2026-27327	4.3	0%	Feb 19	WordPress YayMail – WooCommerce Email Customizer plugin <= 4.3.2 - Broken Access Control vulnerability Affected: through 4.3.2