YayExtra vulnerabilities

3 known vulnerabilities in YayExtra from YayCommerce. 3 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.6 High severity

  YayExtra: Improper Neutralization of Special Elements used in an SQL Command

  CVE-2025-48299Jul 16, 2025YayCommerce

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in YayCommerce YayExtra yayextra allows SQL Injection.This issue affects YayExtra: from n/a through <= 1.5.5.

• 7.6 High severity

  YayExtra: Missing Authorization

  CVE-2025-31415Apr 1, 2025YayCommerce

  Missing Authorization vulnerability in YayCommerce YayExtra yayextra allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects YayExtra: from n/a through <= 1.5.2.

• 9.8 Critical severity

  YayExtra – WooCommerce Extra Product Options: Unrestricted Upload of File with Dangerous Type

  CVE-2024-7257Aug 3, 2024YayCommerceEPSS 1%

  The YayExtra – WooCommerce Extra Product Options plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the handle_upload_file function in all versions up to, and including, 1.3.7. This makes it possible for unauthe