Yithemes vulnerabilities

Products

• Yith Woocommerce Product Add-ons 6
• Yith Woocommerce Ajax Search 4
• Yith Woocommerce Gift Cards 4
• Yith Woocommerce Product Add-ons 4
• Yith Woocommerce Wishlist 4
• Yith Maintenance Mode 3
• Yith Paypal Express Checkout For Woocommerce 3
• Yith Woocommerce Ajax Search 3
• Yith Custom Login 2
• Yith Custom Login 2
• Yith Woocommerce Compare 2
• Yith Woocommerce Popup 2
• Yith Woocommerce Request A Quote 2
• Yith Woocommerce Social Login 2
• Yith Woocommerce Tab Manager 2

Newest

• yith woocommerce product add-ons, yithemes yith woocommerce product add-ons +1 more WordPress YITH WooCommerce Product Add-Ons plugin <= 4.34.0 - Bypass Vulnerability vulnerability CVE-2026-107868 5.3 MediumOctober 30, 2026
• yith paypal express checkout for woocommerce, yithemes yith paypal express checkout for woocommerce +1 more WordPress YITH PayPal Express Checkout for WooCommerce plugin <= 1.62.0 - Broken Access Control vulnerability CVE-2026-27401 5.3 MediumOctober 29, 2026
• yith paypal express checkout for woocommerce, yithemes yith paypal express checkout for woocommerce +1 more WordPress YITH PayPal Express Checkout for WooCommerce plugin <= 1.61.0 - Broken Access Control vulnerability CVE-2026-111409 5.3 MediumOctober 16, 2026
• unknown yith woocommerce popup YITH WooCommerce Popup < 1.60.0 - Contributor+ Arbitrary Post Meta Deletion CVE-2026-92426 4.9 MediumOctober 14, 2026
• yith woocommerce tab manager, yithemes yith woocommerce tab manager +1 more WordPress YITH WooCommerce Tab Manager plugin <= 2.15.0 - Cross Site Scripting (XSS) vulnerability CVE-2026-97292 6.5 MediumSeptember 30, 2026
• unknown yith woocommerce ajax search WordPress YITH WooCommerce Ajax Search plugin <= 2.28.0 - Cross Site Scripting (XSS) vulnerability CVE-2026-96352 7.1 HighSeptember 30, 2026
• yith woocommerce request a quote, yithemes yith woocommerce request a quote +1 more WordPress YITH WooCommerce Request A Quote plugin < 4.46.1 - Insecure Direct Object References (IDOR) vulnerability CVE-2026-95602 6.5 MediumSeptember 23, 2026
• yithemes yith woocommerce zoom magnifier WordPress YITH WooCommerce Zoom Magnifier plugin <= 2.52.0 - Sensitive Data Exposure vulnerability CVE-2026-28169 5.3 MediumAugust 6, 2026
• yith woocommerce compare, yithemes yith woocommerce compare +1 more WordPress YITH WooCommerce Compare plugin <= 3.6.0 - Deserialization of untrusted data vulnerability CVE-2026-22333 7.2 HighFebruary 19, 2026
• yithemes yith woocommerce request a quote WordPress YITH WooCommerce Request A Quote plugin <= 2.46.0 - Broken Access Control vulnerability CVE-2026-24366 5.3 MediumJanuary 22, 2026
• yithemes yith slider for page builders WordPress YITH Slider for page builders plugin <= 1.0.11 - Broken Access Control vulnerability CVE-2025-68581 5.4 MediumDecember 24, 2025
• yithemes yith woocommerce quick view YITH WooCommerce Quick View <= 2.7.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via yith_quick_view Shortcode CVE-2025-8617 6.4 MediumDecember 13, 2025
• yith woocommerce wishlist, yithemes yith woocommerce wishlist +1 more YITH WooCommerce Wishlist <= 4.10.0 - Unauthenticated Insecure Direct Object Reference to Unauthenticated Wishlist Rename CVE-2025-12427 5.3 MediumNovember 19, 2025
• yith woocommerce wishlist, yithemes yith woocommerce wishlist +1 more YITH WooCommerce Wishlist <= 4.10.0 - Unauthenticated Wishlist Token Disclosure to Wishlist Item Deletion CVE-2025-12777 5.3 MediumNovember 19, 2025
• yithemes yith woocommerce popup WordPress YITH WooCommerce Popup Plugin plugin <= 1.48.0 - Cross Site Request Forgery (CSRF) Vulnerability CVE-2025-54675 4.3 MediumAugust 14, 2025
• yithemes yith paypal express checkout for woocommerce WordPress YITH PayPal Express Checkout for WooCommerce plugin <= 1.49.0 - Cross Site Request Forgery (CSRF) vulnerability CVE-2025-48111 4.3 MediumJune 17, 2025
• yith woocommerce wishlist, yithemes yith woocommerce wishlist +1 more YITH WooCommerce Wishlist <= 4.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter CVE-2025-5238 6.4 MediumJune 14, 2025
• yith woocommerce product add-ons, yithemes yith woocommerce product add-ons +1 more WordPress YITH WooCommerce Product Add-Ons plugin <= 4.2.0 - Broken Access Control vulnerability CVE-2023-46635 5.3 MediumJanuary 2, 2025
• yith woocommerce product add-ons, yithemes yith woocommerce product add-ons +1 more WordPress YITH WooCommerce Product Add-Ons plugin <= 4.14.1 - Reflected Cross Site Scripting (XSS) vulnerability CVE-2024-50448 7.1 HighOctober 28, 2024
• unknown yith woocommerce ajax search WordPress YITH WooCommerce Ajax Search plugin <= 2.8.0 - SQL Injection vulnerability CVE-2024-47350 9.3 CriticalOctober 6, 2024
• yith woocommerce product add-ons, yithemes yith woocommerce product add-ons +1 more WordPress YITH WooCommerce Product Add-Ons plugin <= 4.13.0 - Reflected Cross Site Scripting (XSS) vulnerability CVE-2024-47367 7.1 HighOctober 6, 2024
• unknown yith woocommerce ajax search YITH WooCommerce Ajax Search < 2.7.1 - Contributor+ Stored XSS CVE-2024-7846 5.4 MediumSeptember 23, 2024
• yithemes yith custom login YITH Custom Login <= 1.7.3 - Reflected Cross-Site Scripting CVE-2024-8665 Fix available 6.1 MediumSeptember 13, 2024
• yith woocommerce ajax product filter, yithemes yith woocommerce ajax product filter +1 more WordPress YITH WooCommerce Ajax Product Filter plugin <= 5.1.0 - Reflected Cross Site Scripting (XSS) vulnerability CVE-2024-37943 5.8 MediumJuly 20, 2024
• wpweb woocommerce - social login, wpwebelite woocommerce social login, yithemes yith woocommerce social login +2 more WooCommerce - Social Login <= 2.7.3 - Unauthenticated Privilege Escalation via One-Time Password CVE-2024-6637 7.3 HighJuly 20, 2024
• yithemes yith essential kit for woocommerce #1, yith essential kit for woocommerce +1 more YITH Essential Kit for WooCommerce #1 <= 2.34.0 - Missing Authorization to Authenticated (Subscriber+) Limited Plugin Install, Activation, and Deactivation CVE-2024-6799 4.3 MediumJuly 19, 2024
• yith woocommerce product add-ons, yithemes yith woocommerce product add-ons +1 more WordPress YITH WooCommerce Product Add-Ons plugin <= 4.9.2 - Content Injection vulnerability CVE-2024-35680 5.3 MediumJune 10, 2024
• yith woocommerce account funds premium, yithemes woocommerce account funds, yith woocommerce account funds premium +2 more WordPress YITH WooCommerce Account Funds Premium plugin <= 1.32.0 - Broken Access Control vulnerability CVE-2024-30470 6.5 MediumJune 9, 2024
• yith woocommerce tab manager, yithemes yith woocommerce tab manager +1 more WordPress YITH WooCommerce Tab Manager plugin <= 1.35.0 - Cross Site Scripting (XSS) vulnerability CVE-2024-35698 5.9 MediumJune 8, 2024
• yithemes yith custom login WordPress YITH Custom Login plugin <= 1.7.0 - Cross Site Scripting (XSS) vulnerability CVE-2024-35732 5.9 MediumJune 8, 2024
• yith woocommerce wishlist, yithemes yith woocommerce wishlist +1 more WordPress YITH WooCommerce Wishlist plugin <= 3.32.0 - Cross Site Scripting (XSS) vulnerability CVE-2024-34385 5.9 MediumJune 3, 2024
• unknown yith woocommerce ajax search YITH WooCommerce Ajax Search <= 2.4.0 - Unauthenticated Stored Cross-Site Scripting CVE-2024-4455 7.2 HighMay 24, 2024
• yith woocommerce gift cards, yithemes yith woocommerce gift cards +1 more YITH WooCommerce Gift Cards <= 4.12.0 - Missing Authorization to Unauthenticated WooCommerce Settings Update CVE-2024-0870 5.3 MediumMay 14, 2024
• wordpress yith woocommerce compare, yith woocommerce compare +1 more WordPress YITH WooCommerce Compare plugin <= 2.37.0 - Cross Site Request Forgery (CSRF) vulnerability CVE-2024-32699 4.3 MediumApril 24, 2024
• yith woocommerce product add-ons, yithemes yith woocommerce product add-ons +1 more WordPress YITH WooCommerce Product Add-Ons plugin <= 4.5.0 - Cross Site Scripting (XSS) vulnerability CVE-2024-27994 7.1 HighMarch 21, 2024
• yith woocommerce product add-ons, yithemes yith woocommerce product add-ons +1 more WordPress YITH WooCommerce Product Add-Ons Plugin <= 4.3.0 is vulnerable to PHP Object Injection CVE-2023-49777 9.1 CriticalDecember 31, 2023
• yith woocommerce gift cards, yithemes yith woocommerce gift cards +1 more WordPress YITH WooCommerce Gift Cards Premium Plugin <= 3.19.0 is vulnerable to Arbitrary File Upload CVE-2022-45359 EPSS 13.5% 9.8 CriticalDecember 6, 2022
• yithemes woocommerce affiliate, elliot sowersby, relywp woocommerce affiliate plugin – coupon affiliates +1 more Coupon Affiliates < 4.16.4.5 - Unauthenticated Stored XSS CVE-2022-0818 6.1 MediumMarch 28, 2022
• yith maintenance mode (wordpress plugin), yithemes yith maintenance mode +1 more YITH Maintenance Mode (WordPress plugin) <= 1.3.8 - Multiple Authenticated Stored Cross-Site Scripting (XSS) vulnerabilities CVE-2021-36845 6.9 MediumSeptember 27, 2021
• yith maintenance mode (wordpress plugin), yithemes yith maintenance mode +1 more YITH Maintenance Mode (WordPress plugin) <= 1.3.7 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability. CVE-2021-36841 6.9 MediumSeptember 27, 2021
• yithemes yith woocommerce gift cards An arbitrary file upload vulnerability in the YITH WooCommerce Gift Cards Premium plugin before 3... CVE-2021-3120 EPSS 36.8% 9.8 CriticalFebruary 22, 2021
• yithemes yith advanced refund system for woocommerce, yith color and label variations for woocommerce, yith custom thank you page for woocommerce +35 more +37 more plugin-fw/lib/yit-plugin-panel-wc.php in the YIT Plugin Framework through 3.3.8 for WordPress... CVE-2019-16251 4.3 MediumOctober 31, 2019
• yithemes yith maintenance mode The yith-maintenance-mode plugin before 1.2.0 for WordPress has CSRF with resultant XSS via the... CVE-2015-9429 6.5 MediumSeptember 26, 2019