PatchSiren

YayCommerce CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

HIGH YayCommerce CVE published 2026-04-08

CVE-2026-39496

A Blind SQL Injection vulnerability was discovered in the YayMail plugin, affecting versions from n/a through <= 4.3.3. This issue, tracked as CVE-2026-39496, has a CVSS score of 7.6 and is classified as HIGH severity. The vulnerability allows attackers to inject malicious SQL code into the plugin's database, potentially leading to unauthorized data extraction or modification. Users of the YayMail plugin, [truncated]