YayMail vulnerabilities

The YayMail WordPress plugin in versions up to 4.4.6 contains a PHP Object Injection vulnerability exploitable by a shop manager user. This can lead to injection of a malicious PHP object and further exploitation.

There is a PHP Object Injection vulnerability in the shop manager in YayMail versions <= 4.3.3.

The YayMail plugin by YayCommerce up to version 4.3.3 inclusive is vulnerable to Blind SQL Injection due to improper neutralization of special elements used in an SQL command.