Yaypricing

Submit a proposal Propose CVE/GCVE/GHSA reference

Approved changes feed: RSS · Atom

cpe:2.3:a:unknown:yaypricing:*:*:*:*:*:*:*:*

part: a version: * update: *

VendorUnknown (668ca391-a6cc-5e33-879b-83885214de33)
ProductYaypricing (ab63be39-9a4d-565c-935d-889774743002)
Edition*
Language*
Software edition*
Target software*
Target hardware*
Other*
NotesImported from gcve-enriched-dumps CVE data

PURL mappings

PURLSourceLast updated
No PURL mappings for this CPE yet.

Vulnerability references

IdentifiercpeApplicabilitySubmitteddb.gcve.eu detailsRationale
CVE:CVE-2026-15230 vulnerable 2026-09-16 04:33:06.638220 YayPricing < 3.5.7 - Subscriber+ Pricing Configuration Modification and Coupon Code Disclosure
The YayPricing WordPress plugin before 3.5.7 does not perform capability checks on several of its REST API routes, relying only on a shared nonce, allowing any authenticated user such as a subscriber to overwrite the store's pricing configuration and to disclose private coupon codes.
Published: 2026-08-05T06:00:11.884Z
Updated: 2026-08-05T15:12:26.003Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2026-87888 vulnerable 2026-09-16 04:33:01.130770 YayPricing < 3.5.7 - Subscriber+ Stored XSS via save_page_data REST Route
The YayPricing WordPress plugin before 3.5.7 does not perform an authorization check on a REST route that saves its pricing rules, allowing users with the subscriber role and above to store JavaScript that executes in the browser of an administrator who opens the YayPricing WordPress plugin before 3.5.7's settings page.
Published: 2026-09-12T06:00:12.672Z
Updated: 2026-09-12T15:29:41.359Z
Reference links
Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.