WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
yawave
Published
2025-02-24
Title
Yawave <= 2.9.1 - Unauthenticated SQL Injection
Slug
yawpp
Published
2014-09-19
Title
YAWPP < 1.2.2 - SQL Injection
Slug
yawpp
Published
2014-09-19
Title
YAWPP < 1.2.2 - SQL Injection
Slug
yawpp
Published
2015-12-09
Title
YAWPP <= 1.2.2 - Unauthenticated Stored Cross-Site Scripting (XSS)
Slug
yaycurrency
Published
2025-09-26
Title
YayCurrency < 3.3.2 - Admin+ Remote Code Execution
Slug
yaycurrency
Published
2026-02-09
Title
YayCurrency < 3.3.1 - Missing Authorization to Unauthenticated Arbitrary Post Deletion
Slug
yayextra
Published
2024-08-02
Title
YayExtra – WooCommerce Extra Product Options < 1.3.8 - Unauthenticated Arbitrary File Upload via handle_upload_file Function
Slug
yayextra
Published
2025-03-31
Title
YayExtra < 1.5.3 - Missing Authorization
Slug
yayextra
Published
2025-07-16
Title
YayExtra < 1.5.6 - Authenticated (Administrator+) SQL Injection
Slug
yayforms
Published
2025-02-18
Title
Yay! Forms | Embed Custom Forms, Surveys, and Quizzes Easily < 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
yaymail
Published
2026-02-17
Title
YayMail < 4.3.3 - Shop Manager+ Arbitrary Options Update
Slug
yaymail
Published
2026-02-17
Title
YayMail < 4.3.3 - Missing Authorization to Authenticated (Shop Manager+) License Key Deletion via '/yaymail-license/v1/license/delete' Endpoint
Slug
yaymail
Published
2026-02-17
Title
YayMail < 4.3.3 - Authenticated (Shop Manager+) Stored Cross-Site Scripting via Template Elements
Slug
yaymail
Published
2026-02-17
Title
YayMail < 4.3.3 - Missing Authorization to Authenticated (Shop Manager+) Plugin Installation and Activation
Slug
yaypricing
Published
2025-08-29
Title
YayPricing < 3.5.4 - Missing Authorization
Slug
yaysmtp
Published
2022-07-11
Title
YaySMTP < 2.2.1 - Subscriber+ Logs Disclosure
Slug
yaysmtp
Published
2022-07-11
Title
YaySMTP < 2.2.1 - Subscriber+ SMTP Credentials Leak
Slug
yaysmtp
Published
2022-07-18
Title
YaySMTP < 2.2.2 - Admin+ Stored Cross-Site Scripting
Slug
yaysmtp
Published
2022-07-18
Title
YaySMTP < 2.2.1 - Subscriber+ Stored Cross-Site Scripting
Slug
yaysmtp
Published
2023-06-12
Title
YaySMTP < 2.4.6 - Unauthenticated Stored Cross-Site Scripting
Slug
yaysmtp
Published
2025-02-18
Title
YaySMTP 2.4.9 - 2.6.3 - Unauthenticated Stored Cross-Site Scripting
Slug
yaysmtp
Published
2025-05-07
Title
YaySMTP < 2.6.5 - Authenticated (Administrator+) SQL Injection
Slug
yaysmtp
Published
2025-06-27
Title
YaySMTP < 2.6.7 - Admin+ SQL Injection
Slug
ycontributors
Published
2025-07-03
Title
yContributors <= 0.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Slug
ycyclista
Published
2025-01-16
Title
yCyclista <= 1.2.3 - Reflected Cross-Site Scripting