Yithemes vulnerabilities
37 vulnerabilities
Known vulnerabilities in Yithemes products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 48 products.
Products
48- Yith Woocommerce Product Add Ons7 vulnerabilities
- Yith Woocommerce Ajax Search5 vulnerabilities
- Yith Woocommerce Wishlist5 vulnerabilities
- Yith Woocommerce Gift Cards4 vulnerabilities
- Yith Maintenance Mode3 vulnerabilities
- Yith Woocommerce Compare3 vulnerabilities
- Yith Custom Login2 vulnerabilities
- Yith Paypal Express Checkout For Woocommerce2 vulnerabilities
- Yith Woocommerce Quick View2 vulnerabilities
- Yith Woocommerce Request A Quote2 vulnerabilities
- Yith Woocommerce Tab Manager2 vulnerabilities
- Yith Woocommerce Zoom Magnifier2 vulnerabilities
- Woocommerce Account Funds1 vulnerabilities
- Woocommerce Affiliate1 vulnerabilities
- Yith Advanced Refund System For Woocommerce1 vulnerabilities
- Yith Color And Label Variations For Woocommerce1 vulnerabilities
- Yith Custom Thank You Page For Woocommerce1 vulnerabilities
- Yith Desktop Notifications For Woocommerce1 vulnerabilities
- Yith Essential Kit For Woocommerce1 vulnerabilities
- YITH Essential Kit For Woocommerce #11 vulnerabilities
- Yith Pre Order For Woocommerce1 vulnerabilities
- Yith Product Size Charts For Woocommerce1 vulnerabilities
- YITH Slider For Page Builders1 vulnerabilities
- Yith Woocommerce Added To Cart Popup1 vulnerabilities
- Yith Woocommerce Advanced Reviews1 vulnerabilities
- Yith Woocommerce Affiliates1 vulnerabilities
- YITH Woocommerce Ajax Product Filter1 vulnerabilities
- Yith Woocommerce Authorize.Net Payment Gateway1 vulnerabilities
- Yith Woocommerce Badge Management1 vulnerabilities
- Yith Woocommerce Best Sellers1 vulnerabilities
- Yith Woocommerce Brands Add On1 vulnerabilities
- Yith Woocommerce Bulk Product Editing1 vulnerabilities
- Yith Woocommerce Cart Messages1 vulnerabilities
- Yith Woocommerce Frequently Bought Together1 vulnerabilities
- Yith Woocommerce Mailchimp1 vulnerabilities
- Yith Woocommerce Multi Vendor1 vulnerabilities
- Yith Woocommerce Multi Step Checkout1 vulnerabilities
- Yith Woocommerce Order Tracking1 vulnerabilities
- Yith Woocommerce Pdf Invoice And Shipping List1 vulnerabilities
- Yith Woocommerce Points And Rewards1 vulnerabilities
- YITH Woocommerce Popup1 vulnerabilities
- Yith Woocommerce Product Bundles1 vulnerabilities
- Yith Woocommerce Questions And Answers1 vulnerabilities
- Yith Woocommerce Recover Abandoned Cart1 vulnerabilities
- Yith Woocommerce Social Login1 vulnerabilities
- Yith Woocommerce Stripe1 vulnerabilities
- Yith Woocommerce Subscription1 vulnerabilities
- Yith Woocommerce Waiting List1 vulnerabilities
MediumCVE-2021-36845wordpress · yith-maintenance-mode +2 moreYITH Maintenance Mode (WordPress plugin) <= 1.3.8 - Multiple Authenticated Stored Cross-Site Scripting (XSS) vulnerabilitiesMultiple Authenticated Stored Cross-Site Scripting (XSS) vulnerabilities in YITH Maintenance Mode (WordPress plugin) versions <= 1.3.8, there are 46 vulnerable parameters that were missed by the vendor while patching the 1.3.7 version to 1.3.8. Vulnerable parameters: 1 - "Newsletter" tab, &yith_maintenance_newsletter_submit_label parameter: payload should start with a single quote (') symbol to break the context, i.e.: NOTIFY ME' autofocus onfocus=alert(/Visse/);// v=' - this payload will be auto triggered while admin visits this page/tab. 2 - "General" tab issues, vulnerable parameters: &yith_maintenance_message, &yith_maintenance_custom_style, &yith_maintenance_mascotte, &yith_maintenance_title_font[size], &yith_maintenance_title_font[family], &yith_maintenance_title_font[color], &yith_maintenance_paragraph_font[size], &yith_maintenance_paragraph_font[family], &yith_maintenance_paragraph_font[color], &yith_maintenance_border_top. 3 - "Background" tab issues, vulnerable parameters: &yith_maintenance_background_image, &yith_maintenance_background_color. 4 - "Logo" tab issues, vulnerable parameters: &yith_maintenance_logo_image, &yith_maintenance_logo_tagline, &yith_maintenance_logo_tagline_font[size], &yith_maintenance_logo_tagline_font[family], &yith_maintenance_logo_tagline_font[color]. 5 - "Newsletter" tab issues, vulnerable parameters: &yith_maintenance_newsletter_email_font[size], &yith_maintenance_newsletter_email_font[family], &yith_maintenance_newsletter_email_font[color], &yith_maintenance_newsletter_submit_font[size], &yith_maintenance_newsletter_submit_font[family], &yith_maintenance_newsletter_submit_font[color], &yith_maintenance_newsletter_submit_background, &yith_maintenance_newsletter_submit_background_hover, &yith_maintenance_newsletter_title, &yith_maintenance_newsletter_action, &yith_maintenance_newsletter_email_label, &yith_maintenance_newsletter_email_name, &yith_maintenance_newsletter_submit_label, &yith_maintenance_newsletter_hidden_fields. 6 - "Socials" tab issues, vulnerable parameters: &yith_maintenance_socials_facebook, &yith_maintenance_socials_twitter, &yith_maintenance_socials_gplus, &yith_maintenance_socials_youtube, &yith_maintenance_socials_rss, &yith_maintenance_socials_skype, &yith_maintenance_socials_email, &yith_maintenance_socials_behance, &yith_maintenance_socials_dribble, &yith_maintenance_socials_flickr, &yith_maintenance_socials_instagram, &yith_maintenance_socials_pinterest, &yith_maintenance_socials_tumblr, &yith_maintenance_socials_linkedin.EPSS0.71%MediumCVE-2021-36841wordpress · yith-maintenance-mode +2 moreYITH Maintenance Mode (WordPress plugin) <= 1.3.7 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability.Authenticated Stored Cross-Site Scripting (XSS) vulnerability in YITH Maintenance Mode (WordPress plugin) versions <= 1.3.7, vulnerable parameter &yith_maintenance_newsletter_submit_label. Possible even when unfiltered HTML is disallowed by WordPress configuration.EPSS0.63%CriticalCVE-2021-3120wordpress · yith-woocommerce-gift-cards-premium +1 morewordpress yith-woocommerce-gift-cards-premiumAn arbitrary file upload vulnerability in the YITH WooCommerce Gift Cards Premium plugin before 3.3.1 for WordPress allows remote attackers to achieve remote code execution on the operating system in the security context of the web server. In order to exploit this vulnerability, an attacker must be able to place a valid Gift Card product into the shopping cart. An uploaded file is placed at a predetermined path on the web server with a user-specified filename and extension. This occurs because the ywgc-upload-picture parameter can have a .php value even though the intention was to only allow uploads of Gift Card images.EPSS36.78%MediumCVE-2015-9429wordpress · yith-maintenance-mode +1 morewordpress yith-maintenance-modeThe yith-maintenance-mode plugin before 1.2.0 for WordPress has CSRF with resultant XSS via the wp-admin/themes.php?page=yith-maintenance-mode panel_page parameter.EPSS0.87%MediumCVE-2025-54675wordpress · yith-woocommerce-popup +1 moreWordPress YITH WooCommerce Popup Plugin plugin <= 1.48.0 - Cross Site Request Forgery (CSRF) VulnerabilityCross-Site Request Forgery (CSRF) vulnerability in YITHEMES YITH WooCommerce Popup yith-woocommerce-popup allows Cross Site Request Forgery.This issue affects YITH WooCommerce Popup: from n/a through <= 1.48.0.EPSS0.15%MediumCVE-2025-68581wordpress · yith-slider-for-page-builders +1 moreWordPress YITH Slider for page builders plugin <= 1.0.11 - Broken Access Control vulnerabilityMissing Authorization vulnerability in YITHEMES YITH Slider for page builders yith-slider-for-page-builders allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects YITH Slider for page builders: from n/a through <= 1.0.11.EPSS0.20%MediumCVE-2025-48111wordpress · yith-paypal-express-checkout-for-woocommerce +1 moreWordPress YITH PayPal Express Checkout for WooCommerce plugin <= 1.49.0 - Cross Site Request Forgery (CSRF) vulnerabilityCross-Site Request Forgery (CSRF) vulnerability in YITHEMES YITH PayPal Express Checkout for WooCommerce allows Cross Site Request Forgery. This issue affects YITH PayPal Express Checkout for WooCommerce: from n/a through 1.49.0.EPSS0.16%MediumCVE-2025-5238wordpress · yith-woocommerce-wishlist +1 moreYITH WooCommerce Wishlist <= 4.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via id ParameterThe YITH WooCommerce Wishlist plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘id’ parameter in all versions up to, and including, 4.5.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.EPSS0.30%MediumCVE-2025-12427wordpress · yith-woocommerce-wishlist +1 moreYITH WooCommerce Wishlist <= 4.10.0 - Unauthenticated Insecure Direct Object Reference to Unauthenticated Wishlist RenameThe YITH WooCommerce Wishlist plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.10.0 via the REST API endpoint and AJAX handler due to missing validation on user-controlled keys. This makes it possible for unauthenticated attackers to discover any user's wishlist token ID, and subsequently rename the victim's wishlist without authorization (integrity impact). This can be exploited to target multi-user stores for defacement, social engineering attacks, mass tampering, and profiling at scale.EPSS0.30%MediumCVE-2025-12777wordpress · yith-woocommerce-wishlist +1 moreYITH WooCommerce Wishlist <= 4.10.0 - Unauthenticated Wishlist Token Disclosure to Wishlist Item DeletionThe YITH WooCommerce Wishlist plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.10.0. This is due to the plugin not properly verifying that a user is authorized to perform actions on the REST API /wp-json/yith/wishlist/v1/lists endpoint (which uses permission_callback => '__return_true') and the AJAX delete_item handler (which only checks nonce validity without verifying object-level authorization). This makes it possible for unauthenticated attackers to disclose wishlist tokens for any user and subsequently delete wishlist items by chaining the REST API authorization bypass with the exposed delete_item nonce on shared wishlist pages and the AJAX handler's missing object-level authorization check.EPSS0.33%MediumCVE-2025-8617wordpress · yith-woocommerce-quick-view +1 moreYITH WooCommerce Quick View <= 2.7.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via yith_quick_view ShortcodeThe YITH WooCommerce Quick View plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's yith_quick_view shortcode in all versions up to, and including, 2.7.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.EPSS0.29%HighCVE-2022-0818unknown · woocommerce affiliate plugin – coupon affiliates +2 moreCoupon Affiliates < 4.16.4.5 - Unauthenticated Stored XSSThe WooCommerce Affiliate Plugin WordPress plugin before 4.16.4.5 does not have authorization and CSRF checks on a specific action handler, as well as does not sanitize its settings, which enables an unauthenticated attacker to inject malicious XSS payloads into the settings page of the plugin.EPSS0.87%CriticalCVE-2022-45359wordpress · yith-woocommerce-gift-cards-premium +2 moreWordPress YITH WooCommerce Gift Cards Premium Plugin <= 3.19.0 is vulnerable to Arbitrary File UploadUnauth. Arbitrary File Upload vulnerability in YITH WooCommerce Gift Cards premium plugin <= 3.19.0 on WordPress.EPSS13.51%HighCVE-2024-47367wordpress · yith-woocommerce-product-add-ons +1 moreWordPress YITH WooCommerce Product Add-Ons plugin <= 4.13.0 - Reflected Cross Site Scripting (XSS) vulnerabilityImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in YITHEMES YITH WooCommerce Product Add-Ons yith-woocommerce-product-add-ons allows Reflected XSS.This issue affects YITH WooCommerce Product Add-Ons: from n/a through <= 4.13.0.EPSS0.32%CriticalCVE-2024-47350wordpress · yith-woocommerce-ajax-search +1 moreWordPress YITH WooCommerce Ajax Search plugin <= 2.8.0 - SQL Injection vulnerabilityImproper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in YITHEMES YITH WooCommerce Ajax Search yith-woocommerce-ajax-search.This issue affects YITH WooCommerce Ajax Search: from n/a through <= 2.8.0.EPSS0.41%MediumCVE-2024-0870wordpress · yith-woocommerce-gift-cards +1 moreYITH WooCommerce Gift Cards <= 4.12.0 - Missing Authorization to Unauthenticated WooCommerce Settings UpdateThe YITH WooCommerce Gift Cards plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'save_mail_status' and 'save_email_settings' functions in all versions up to, and including, 4.12.0. This makes it possible for unauthenticated attackers to modify WooCommerce settings.EPSS0.50%HighCVE-2024-4455wordpress · yith-woocommerce-ajax-search +1 moreYITH WooCommerce Ajax Search <= 2.4.0 - Unauthenticated Stored Cross-Site ScriptingThe YITH WooCommerce Ajax Search plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘item’ parameter in versions up to, and including, 2.4.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.EPSS1.01%MediumCVE-2024-37943wordpress · yith-woocommerce-ajax-navigation +1 moreWordPress YITH WooCommerce Ajax Product Filter plugin <= 5.1.0 - Reflected Cross Site Scripting (XSS) vulnerabilityImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in YITHEMES YITH WooCommerce Ajax Product Filter yith-woocommerce-ajax-navigation.This issue affects YITH WooCommerce Ajax Product Filter: from n/a through <= 5.1.0.EPSS0.30%MediumCVE-2024-7846unknown · yith woocommerce ajax search +2 moreYITH WooCommerce Ajax Search < 2.7.1 - Contributor+ Stored XSSYITH WooCommerce Ajax Search is vulnerable to a XSS vulnerability due to insufficient sanitization of user supplied block attributes. This makes it possible for Contributors+ attackers to inject arbitrary scripts.EPSS0.33%HighCVE-2024-27994wordpress · yith-woocommerce-product-add-ons +1 moreWordPress YITH WooCommerce Product Add-Ons plugin <= 4.5.0 - Cross Site Scripting (XSS) vulnerabilityImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in YITHEMES YITH WooCommerce Product Add-Ons yith-woocommerce-product-add-ons.This issue affects YITH WooCommerce Product Add-Ons: from n/a through <= 4.5.0.EPSS0.40%