YITH vulnerabilities
21 vulnerabilities
Known vulnerabilities in YITH products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 16 products.
Products
16- YITH Woocommerce Product Add Ons3 vulnerabilities
- YITH Maintenance Mode (Wordpress Plugin)2 vulnerabilities
- YITH Woocommerce Product Bundles2 vulnerabilities
- YITH Woocommerce Wishlist2 vulnerabilities
- YITH Paypal Express Checkout For Woocommerce1 vulnerabilities
- YITH Request A Quote For Woocommerce Premium1 vulnerabilities
- YITH Woocommerce Account Funds Premium1 vulnerabilities
- YITH Woocommerce Affiliates1 vulnerabilities
- YITH Woocommerce Compare1 vulnerabilities
- YITH Woocommerce Gift Cards1 vulnerabilities
- YITH Woocommerce Gift Cards Premium1 vulnerabilities
- YITH Woocommerce Membership Premium1 vulnerabilities
- YITH Woocommerce Product Slider Carousel1 vulnerabilities
- YITH Woocommerce Request A Quote1 vulnerabilities
- YITH Woocommerce Waiting List1 vulnerabilities
- YITH Woocommerce Waitlist Premium1 vulnerabilities
MediumCVE-2026-112199yith · yith woocommerce wishlistWordPress YITH WooCommerce Wishlist plugin <= 4.18.1 - Cross Site Scripting (XSS) vulnerabilityImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in YITH YITH WooCommerce Wishlist yith-woocommerce-wishlist allows Stored XSS.This issue affects YITH WooCommerce Wishlist: from n/a through 4.18.1.EPSS0.13%MediumCVE-2026-111845yith · yith woocommerce product bundlesWordPress YITH WooCommerce Product Bundles plugin <= 2.29.0 - Broken Access Control vulnerabilityMissing Authorization vulnerability in YITH YITH WooCommerce Product Bundles yith-woocommerce-product-bundles allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects YITH WooCommerce Product Bundles: from n/a through 2.29.0.EPSS0.18%MediumCVE-2026-111409yith · yith paypal express checkout for woocommerceWordPress YITH PayPal Express Checkout for WooCommerce plugin <= 1.61.0 - Broken Access Control vulnerabilityMissing Authorization vulnerability in YITH YITH PayPal Express Checkout for WooCommerce yith-paypal-express-checkout-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects YITH PayPal Express Checkout for WooCommerce: from n/a through 1.61.0.EPSS0.19%MediumCVE-2026-106604yith · yith woocommerce compareWordPress YITH WooCommerce Compare plugin <= 3.15.0 - Cross Site Scripting (XSS) vulnerabilityImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in YITH YITH WooCommerce Compare yith-woocommerce-compare allows Stored XSS.This issue affects YITH WooCommerce Compare: from n/a through 3.15.0.EPSS0.16%MediumCVE-2021-36845wordpress · yith-maintenance-mode +2 moreYITH Maintenance Mode (WordPress plugin) <= 1.3.8 - Multiple Authenticated Stored Cross-Site Scripting (XSS) vulnerabilitiesMultiple Authenticated Stored Cross-Site Scripting (XSS) vulnerabilities in YITH Maintenance Mode (WordPress plugin) versions <= 1.3.8, there are 46 vulnerable parameters that were missed by the vendor while patching the 1.3.7 version to 1.3.8. Vulnerable parameters: 1 - "Newsletter" tab, &yith_maintenance_newsletter_submit_label parameter: payload should start with a single quote (') symbol to break the context, i.e.: NOTIFY ME' autofocus onfocus=alert(/Visse/);// v=' - this payload will be auto triggered while admin visits this page/tab. 2 - "General" tab issues, vulnerable parameters: &yith_maintenance_message, &yith_maintenance_custom_style, &yith_maintenance_mascotte, &yith_maintenance_title_font[size], &yith_maintenance_title_font[family], &yith_maintenance_title_font[color], &yith_maintenance_paragraph_font[size], &yith_maintenance_paragraph_font[family], &yith_maintenance_paragraph_font[color], &yith_maintenance_border_top. 3 - "Background" tab issues, vulnerable parameters: &yith_maintenance_background_image, &yith_maintenance_background_color. 4 - "Logo" tab issues, vulnerable parameters: &yith_maintenance_logo_image, &yith_maintenance_logo_tagline, &yith_maintenance_logo_tagline_font[size], &yith_maintenance_logo_tagline_font[family], &yith_maintenance_logo_tagline_font[color]. 5 - "Newsletter" tab issues, vulnerable parameters: &yith_maintenance_newsletter_email_font[size], &yith_maintenance_newsletter_email_font[family], &yith_maintenance_newsletter_email_font[color], &yith_maintenance_newsletter_submit_font[size], &yith_maintenance_newsletter_submit_font[family], &yith_maintenance_newsletter_submit_font[color], &yith_maintenance_newsletter_submit_background, &yith_maintenance_newsletter_submit_background_hover, &yith_maintenance_newsletter_title, &yith_maintenance_newsletter_action, &yith_maintenance_newsletter_email_label, &yith_maintenance_newsletter_email_name, &yith_maintenance_newsletter_submit_label, &yith_maintenance_newsletter_hidden_fields. 6 - "Socials" tab issues, vulnerable parameters: &yith_maintenance_socials_facebook, &yith_maintenance_socials_twitter, &yith_maintenance_socials_gplus, &yith_maintenance_socials_youtube, &yith_maintenance_socials_rss, &yith_maintenance_socials_skype, &yith_maintenance_socials_email, &yith_maintenance_socials_behance, &yith_maintenance_socials_dribble, &yith_maintenance_socials_flickr, &yith_maintenance_socials_instagram, &yith_maintenance_socials_pinterest, &yith_maintenance_socials_tumblr, &yith_maintenance_socials_linkedin.EPSS0.71%MediumCVE-2021-36841wordpress · yith-maintenance-mode +2 moreYITH Maintenance Mode (WordPress plugin) <= 1.3.7 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability.Authenticated Stored Cross-Site Scripting (XSS) vulnerability in YITH Maintenance Mode (WordPress plugin) versions <= 1.3.7, vulnerable parameter &yith_maintenance_newsletter_submit_label. Possible even when unfiltered HTML is disallowed by WordPress configuration.EPSS0.63%MediumCVE-2022-44630wordpress · yith-color-and-label-variations-for-woocommerce +45 moreWordPress YITH WooCommerce Product Slider Carousel plugin <= 1.16.0 - Cross-Site Request Forgery (CSRF)Cross-Site request forgery (CSRF) vulnerability in YITH YITH WooCommerce Product Slider Carousel allows Cross Site Request Forgery.
This issue affects YITH WooCommerce Product Slider Carousel: from n/a through 1.16.0.EPSS0.14%MediumCVE-2022-44633wordpress · yith-woocommerce-gift-cards-premium +1 moreWordPress YITH WooCommerce Gift Cards Premium plugin <= 3.23.1 - Unauth. Gift Card Creation Leading to Stored XSS vulnerabilityMissing Authorization vulnerability in YITH YITH WooCommerce Gift Cards Premium.This issue affects YITH WooCommerce Gift Cards Premium: from n/a through 3.23.1.EPSS0.47%CriticalCVE-2022-45359wordpress · yith-woocommerce-gift-cards-premium +2 moreWordPress YITH WooCommerce Gift Cards Premium Plugin <= 3.19.0 is vulnerable to Arbitrary File UploadUnauth. Arbitrary File Upload vulnerability in YITH WooCommerce Gift Cards premium plugin <= 3.19.0 on WordPress.EPSS13.51%HighCVE-2024-30470wordpress · yith-woocommerce-account-funds-premium +2 moreWordPress YITH WooCommerce Account Funds Premium plugin <= 1.32.0 - Broken Access Control vulnerabilityMissing Authorization vulnerability in YITH YITH WooCommerce Account Funds Premium.This issue affects YITH WooCommerce Account Funds Premium: from n/a through 1.33.0.EPSS0.38%MediumCVE-2026-105878wordpress · yith-woocommerce-product-bundles +1 moreWordPress YITH WooCommerce Product Bundles plugin <= 2.29.0 - Broken Access Control vulnerabilityMissing Authorization vulnerability in YITH YITH WooCommerce Product Bundles yith-woocommerce-product-bundles allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects YITH WooCommerce Product Bundles: from n/a through 2.29.0.EPSS0.18%CriticalCVE-2026-84238wordpress · yith-woocommerce-request-a-quote-premium +1 moreWordPress YITH Request a Quote for WooCommerce Premium plugin < 4.46.0 - Broken Access Control vulnerabilityUnauthenticated Broken Access Control in YITH Request a Quote for WooCommerce Premium < 4.46.0 versions.EPSS0.48%HighCVE-2026-42383wordpress · yith-woocommerce-product-add-ons +1 moreWordPress YITH WooCommerce Product Add-Ons plugin <= 4.29.0 - SQL Injection vulnerabilityImproper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in YITH YITH WooCommerce Product Add-Ons allows Blind SQL Injection.
This issue affects YITH WooCommerce Product Add-Ons: from n/a through 4.29.0.EPSS0.38%HighCVE-2026-14359wordpress · yith-woocommerce-waiting-list-premium +1 moreYITH WooCommerce Waitlist Premium <= 3.35.0 - Authenticated (Subscriber+) Privilege Escalation to Admin via wp_ajax_yith_wcwtl_add_userThe YITH WooCommerce Waitlist Premium plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 3.35.0. This is due to the add_user_in_waiting_list() function registered on the wp_ajax_yith_wcwtl_add_user action being missing both a capability check and a nonce verification, and using parse_str() + extract() to import attacker-controlled variables from $_POST['params'] that are then passed to wp_create_user() and $user->set_role(). This makes it possible for authenticated attackers, with Subscriber-level access and above, to elevate their privileges to that of an administrator by creating a new user account and assigning it the administrator role.EPSS0.24%MediumCVE-2026-66480yith · yith woocommerce product add-onsWordPress YITH WooCommerce Product Add-Ons plugin <= 4.34.0 - Sensitive Data Exposure vulnerabilityExposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in YITH YITH WooCommerce Product Add-Ons allows Retrieve Embedded Sensitive Data.
This issue affects YITH WooCommerce Product Add-Ons: from n/a through 4.34.0.EPSS0.20%MediumCVE-2026-27329wordpress · yith-woocommerce-wishlist +1 moreWordPress YITH WooCommerce Wishlist plugin <= 4.12.0 - Insecure Direct Object References (IDOR) vulnerabilityAuthorization Bypass Through User-Controlled Key vulnerability in YITH YITH WooCommerce Wishlist allows Exploiting Incorrectly Configured Access Control Security Levels.
This issue affects YITH WooCommerce Wishlist: from n/a through 4.12.0.EPSS0.33%HighCVE-2026-106606wordpress · yith-woocommerce-affiliates +1 moreWordPress YITH WooCommerce Affiliates plugin <= 3.31.0 - PHP Object Injection vulnerabilityDeserialization of Untrusted Data vulnerability in YITH YITH WooCommerce Affiliates yith-woocommerce-affiliates allows Object Injection.This issue affects YITH WooCommerce Affiliates: from n/a through 3.31.0.EPSS0.37%MediumCVE-2026-95602wordpress · yith-woocommerce-request-a-quote +1 moreWordPress YITH WooCommerce Request A Quote plugin < 4.46.1 - Insecure Direct Object References (IDOR) vulnerabilityAuthorization Bypass Through User-Controlled Key vulnerability in YITH YITH WooCommerce Request A Quote allows Exploiting Incorrectly Configured Access Control Security Levels.
This issue affects YITH WooCommerce Request A Quote: from n/a before 4.46.1.EPSS0.28%HighCVE-2026-32552wordpress · yith-woocommerce-membership-premium +1 moreWordPress YITH WooCommerce Membership Premium plugin <= 2.33.0 - SQL Injection vulnerabilitySubscriber SQL Injection in YITH WooCommerce Membership Premium <= 2.33.0 versions.EPSS0.36%MediumCVE-2023-36506wordpress · yith-woocommerce-waiting-list +1 moreWordPress YITH WooCommerce Waitlist plugin <= 2.13.0 - Broken Access Control vulnerabilityMissing Authorization vulnerability in YITH YITH WooCommerce Waiting List allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects YITH WooCommerce Waiting List: from n/a through 2.13.0.EPSS0.53%