WordPress plugin

YayMail – WooCommerce Email Customizer security & vulnerabilities

Q: Is any YayMail – WooCommerce Email Customizer vulnerability listed in CISA KEV?

No. None of the known YayMail – WooCommerce Email Customizer vulnerabilities is currently listed in the CISA KEV catalog.

yaymail— active installsLast vulnerability Oct 13, 2026

No known unpatched vulnerabilities in the latest version

All 8 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.

Watch plugin

8Known vulnerabilities

Critical0
High1
Medium6
Low1

Vulnerabilities per year

All YayMail – WooCommerce Email Customizer vulnerabilities

YayMail – WooCommerce Email Customizer vulnerabilities
Severity	Vulnerability	CVE	Published
Medium6.6	Authenticated (Shop Manager+) PHP Object Injection ≤4.4.6Update to 4.4.7	CVE-2026-42701	Oct 13
Medium6.6	Authenticated (Shop manager+) PHP Object Injection ≤4.3.3Update to 4.3.4	CVE-2026-39498	Apr 20
Medium4.9	Authenticated (Shop manager+) SQL Injection ≤4.3.3Update to 4.3.4	CVE-2026-39496	Mar 15
Medium5.3	Missing Authorization to Authenticated (Shop Manager+) License Key Deletion via '/yaymail-license/v1/license/delete' Endpoint ≤4.3.2Update to 4.3.3	CVE-2026-1938	Feb 17
Low2.7	Missing Authorization to Authenticated (Shop Manager+) Plugin Installation and Activation ≤4.3.2Update to 4.3.3	CVE-2026-1831	Feb 17
Medium4.4	Authenticated (Shop Manager+) Stored Cross-Site Scripting via Template Elements ≤4.3.2Update to 4.3.3	CVE-2026-1943	Feb 17
High7.2	Missing Authorization to Authenticated (Shop Manager+) Arbitrary Options Update via 'yaymail_import_state' AJAX Action ≤4.3.2Update to 4.3.3	CVE-2026-1937	Feb 17
Medium4.3	Missing Authorization ≤4.3.2Update to 4.3.3	CVE-2026-27327	Jan 06

Medium6.6
Authenticated (Shop Manager+) PHP Object Injection
≤4.4.6Update to 4.4.7
CVE-2026-42701Oct 13
Medium6.6
Authenticated (Shop manager+) PHP Object Injection
≤4.3.3Update to 4.3.4
CVE-2026-39498Apr 20
Medium4.9
Authenticated (Shop manager+) SQL Injection
≤4.3.3Update to 4.3.4
CVE-2026-39496Mar 15
Medium5.3
Missing Authorization to Authenticated (Shop Manager+) License Key Deletion via '/yaymail-license/v1/license/delete' Endpoint
≤4.3.2Update to 4.3.3
CVE-2026-1938Feb 17
Low2.7
Missing Authorization to Authenticated (Shop Manager+) Plugin Installation and Activation
≤4.3.2Update to 4.3.3
CVE-2026-1831Feb 17
Medium4.4
Authenticated (Shop Manager+) Stored Cross-Site Scripting via Template Elements
≤4.3.2Update to 4.3.3
CVE-2026-1943Feb 17
High7.2
Missing Authorization to Authenticated (Shop Manager+) Arbitrary Options Update via 'yaymail_import_state' AJAX Action
≤4.3.2Update to 4.3.3
CVE-2026-1937Feb 17
Medium4.3
Missing Authorization
≤4.3.2Update to 4.3.3
CVE-2026-27327Jan 06

YayMail – WooCommerce Email Customizer: common questions

Does YayMail – WooCommerce Email Customizer have known vulnerabilities?

Yes. VulnCrest Radar lists 8 known vulnerabilities in YayMail – WooCommerce Email Customizer: 1 high, 6 medium, 1 low. None are known to affect version null.

How do I check which version of YayMail – WooCommerce Email Customizer I run?

In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.

What is the most recent YayMail – WooCommerce Email Customizer vulnerability?

CVE-2026-42701, published Oct 13, 2026: YayMail – WooCommerce Email Customizer <= 4.4.6 - Authenticated (Shop Manager+) PHP Object Injection. Severity: Medium (CVSS 6.6).

Is any YayMail – WooCommerce Email Customizer vulnerability listed in CISA KEV?

No. None of the known YayMail – WooCommerce Email Customizer vulnerabilities is currently listed in the CISA KEV catalog.