MediumCVSS 5.3
EPSS 0.30%
Unauthenticated Bypass Vulnerability in YITH WooCommerce Product Add-Ons <= 4.34.0 versions.
Vendor
YITHEMES vulnerabilities
39 published CVES affecting YITHEMES, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).
- Total
- 39
- Critical
- 3
- High
- 7
- Medium
- 29
- Low
- 0
- Unscored
- 0
- CISA KEV
- 0
Products
- YITH WooCommerce Product Add-Ons 8
- YITH WooCommerce Ajax Search 5
- yith woocommerce wishlist 5
- yith woocommerce gift cards 4
- yith maintenance mode 3
- YITH WooCommerce Compare 3
- YITH Custom Login 2
- yith paypal express checkout for woocommerce 2
- yith woocommerce quick view 2
- YITH WooCommerce Request A Quote 2
- yith woocommerce social login 2
- YITH WooCommerce Tab Manager 2
- YITH WooCommerce Zoom Magnifier 2
- woocommerce account funds 1
- woocommerce affiliate 1
- yith advanced refund system for woocommerce 1
- yith color and label variations for woocommerce 1
- yith custom thank you page for woocommerce 1
- yith desktop notifications for woocommerce 1
- yith essential kit for woocommerce 1
- YITH Essential Kit for WooCommerce #1 1
- yith pre-order for woocommerce 1
- yith product size charts for woocommerce 1
- YITH Slider for page builders 1
- yith woocommerce account funds premium 1
- yith woocommerce added to cart popup 1
- yith woocommerce advanced reviews 1
- yith woocommerce affiliates 1
- YITH WooCommerce Ajax Product Filter 1
- yith woocommerce authorize.net payment gateway 1
Latest YITHEMES CVEs
Newest publication first · page 1 of 2
-
-
MediumCVSS 6.5 EPSS 0.13%
Author Cross Site Scripting (XSS) in YITH WooCommerce Tab Manager <= 2.15.0 versions.
-
HighCVSS 7.1 EPSS 0.18%
Unauthenticated Cross Site Scripting (XSS) in YITH WooCommerce Ajax Search <= 2.28.0 versions.
-
MediumCVSS 5.3 EPSS 0.33%
Unauthenticated Sensitive Data Exposure in YITH WooCommerce Zoom Magnifier <= 2.52.0 versions.
-
HighCVSS 7.2 EPSS 0.54%
Deserialization of Untrusted Data vulnerability in YITHEMES YITH WooCommerce Compare yith-woocommerce-compare allows Object Injection.This issue affects YITH WooCommerce Compare: from n/a through <= 3.6.0.
-
MediumCVSS 5.3 EPSS 0.22%
Missing Authorization vulnerability in YITHEMES YITH WooCommerce Request A Quote yith-woocommerce-request-a-quote allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects YITH WooCommerce Request A Quote: from n/a through <= 2.46.0.
-
MediumCVSS 5.4 EPSS 0.20%
Missing Authorization vulnerability in YITHEMES YITH Slider for page builders yith-slider-for-page-builders allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects YITH Slider for page builders: from n/a through <= 1.0.11.
-
MediumCVSS 6.4 EPSS 0.29%
The YITH WooCommerce Quick View plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's yith_quick_view shortcode in all versions up to, and including, 2.7.0 due to insufficient input sanitization and output escaping on user supplied attributes. This ma...
-
MediumCVSS 5.3 EPSS 0.30%
The YITH WooCommerce Wishlist plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.10.0 via the REST API endpoint and AJAX handler due to missing validation on user-controlled keys. This makes it possible for unauthenticat...
-
MediumCVSS 5.3 EPSS 0.33%
The YITH WooCommerce Wishlist plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.10.0. This is due to the plugin not properly verifying that a user is authorized to perform actions on the REST API /wp-json/yith/wishlist/v1/lists end...
-
MediumCVSS 4.3 EPSS 0.16%
Cross-Site Request Forgery (CSRF) vulnerability in YITHEMES YITH WooCommerce Popup yith-woocommerce-popup allows Cross Site Request Forgery.This issue affects YITH WooCommerce Popup: from n/a through <= 1.48.0.
-
MediumCVSS 4.3 EPSS 0.16%
Cross-Site Request Forgery (CSRF) vulnerability in YITHEMES YITH PayPal Express Checkout for WooCommerce allows Cross Site Request Forgery. This issue affects YITH PayPal Express Checkout for WooCommerce: from n/a through 1.49.0.
-
MediumCVSS 6.4 EPSS 0.31%
The YITH WooCommerce Wishlist plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘id’ parameter in all versions up to, and including, 4.5.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...
-
MediumCVSS 5.3 EPSS 0.42%
Missing Authorization vulnerability in YITHEMES YITH WooCommerce Product Add-Ons yith-woocommerce-product-add-ons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects YITH WooCommerce Product Add-Ons: from n/a through <= 4.2.0.
-
MediumCVSS 6.1 EPSS 0.33%
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in YITHEMES YITH WooCommerce Product Add-Ons yith-woocommerce-product-add-ons.This issue affects YITH WooCommerce Product Add-Ons: from n/a through <= 4.14.1.
-
CVE-2024-47350 WordPress YITH WooCommerce Ajax Search plugin <= 2.8.0 - SQL Injection vulnerability
PublishedCriticalCVSS 9.3 EPSS 0.41%Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in YITHEMES YITH WooCommerce Ajax Search yith-woocommerce-ajax-search.This issue affects YITH WooCommerce Ajax Search: from n/a through <= 2.8.0.
-
HighCVSS 7.1 EPSS 0.32%
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in YITHEMES YITH WooCommerce Product Add-Ons yith-woocommerce-product-add-ons allows Reflected XSS.This issue affects YITH WooCommerce Product Add-Ons: from n/a through <= 4.13.0.
-
MediumCVSS 5.4 EPSS 0.33%
YITH WooCommerce Ajax Search is vulnerable to a XSS vulnerability due to insufficient sanitization of user supplied block attributes. This makes it possible for Contributors+ attackers to inject arbitrary scripts.
-
MediumCVSS 6.1 EPSS 0.49%
The YITH Custom Login plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 1.7.3. This makes it possible for unauthenticated attackers to inject arbitrary...
-
MediumCVSS 5.8 EPSS 0.30%
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in YITHEMES YITH WooCommerce Ajax Product Filter yith-woocommerce-ajax-navigation.This issue affects YITH WooCommerce Ajax Product Filter: from n/a through <= 5.1.0.
-
HighCVSS 7.3 EPSS 0.36%
The WooCommerce - Social Login plugin for WordPress is vulnerable to unauthenticated privilege escalation in all versions up to, and including, 2.7.3. This is due to a lack of brute force controls on a weak one-time password. This makes it possible for unauthenticated attackers t...
-
MediumCVSS 4.3 EPSS 0.33%
The YITH Essential Kit for WooCommerce #1 plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'activate_module', 'deactivate_module', and 'install_module' functions in all versions up to, and including, 2.34.0. This mak...
-
MediumCVSS 5.3 EPSS 0.33%
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in YITHEMES YITH WooCommerce Product Add-Ons yith-woocommerce-product-add-ons.This issue affects YITH WooCommerce Product Add-Ons: from n/a through <= 4.9.2.
-
HighCVSS 8.8 EPSS 0.38%
Missing Authorization vulnerability in YITH YITH WooCommerce Account Funds Premium.This issue affects YITH WooCommerce Account Funds Premium: from n/a through 1.33.0.
-
MediumCVSS 4.8 EPSS 0.28%
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in YITHEMES YITH WooCommerce Tab Manager yith-woocommerce-tab-manager.This issue affects YITH WooCommerce Tab Manager: from n/a through <= 1.35.0.
Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.