Yith
Monthly
PHP Object Injection in YITH WooCommerce Affiliates through version 3.31.0 allows an authenticated attacker who already holds a high-privilege WordPress account to deserialize untrusted input and potentially achieve code execution or otherwise tamper with the site, with high impact to confidentiality, integrity, and availability (CVSS 7.2). The flaw is network-reachable without user interaction, but the PR:H requirement is the key limiter: unprivileged or unauthenticated users cannot reach the vulnerable deserialization path. No public exploit identified at time of analysis and no EPSS score was provided; the primary mitigations are reducing high-privilege accounts and applying a vendor fix once one ships.
Privilege escalation in YITH WooCommerce Waitlist Premium for WordPress (versions ≤3.35.0) allows any subscriber-level authenticated user to manufacture a new WordPress administrator account, achieving full site takeover. The vulnerable AJAX handler add_user_in_waiting_list() is exposed to all logged-in users with no nonce or capability check, and applies parse_str() plus extract() to attacker-supplied POST data before passing the injected variables directly to wp_create_user() and $user->set_role(). No public exploit code or CISA KEV listing has been identified at time of analysis, but the attack mechanics are trivially derivable from the Wordfence disclosure.
Missing authorization in the YITH Request a Quote for WooCommerce Premium plugin (all versions before 4.46.0) lets unauthenticated attackers reach functionality that should be access-controlled, per a Patchstack advisory. The flaw is a broken-access-control / missing-authorization issue (CWE-862) rated CVSS 9.8; no public exploit identified at time of analysis, though the advisory does not detail the exact vulnerable action.
SQL injection in YITH WooCommerce Membership Premium versions 2.33.0 and below allows authenticated subscribers to execute arbitrary SQL queries against the underlying database. Exploitation requires only a low-privilege WordPress subscriber account - the lowest registered user role - making the attack surface broad on any membership-enabled site. The CVSS scope change (S:C) and high confidentiality impact (C:H) indicate that successful exploitation can expose data beyond the plugin itself, including sensitive user and order records stored in the WordPress database. No public exploit code or active exploitation has been identified at time of analysis.
Blind SQL injection in YITH WooCommerce Product Add-Ons (WordPress plugin) through version 4.29.0 allows high-privileged authenticated users to inject malicious SQL into database queries, leading to confidentiality compromise and limited availability impact across a changed security scope. The flaw was disclosed by Patchstack and carries a CVSS 3.1 score of 7.6; no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Missing authorization in YITH PayPal Express Checkout for WooCommerce up to 1.62.0 lets unauthenticated remote attackers perform unauthorized actions that modify site data, with integrity-only impact (CVSS 5.3). No public exploit has been identified at time of analysis, and the flaw is limited to sites running this specific plugin with the vulnerable endpoint network-reachable.
Missing authorization in YITH WooCommerce Product Bundles through 2.29.0 lets unauthenticated remote attackers invoke access-controlled plugin functionality and perform a limited, low-integrity action on WordPress/WooCommerce sites running the plugin. The CVSS 3.1 score is 5.3 (AV:N/AC:L/PR:N/UI:N) with no confidentiality or availability impact; no public exploit was identified at time of analysis, and there is no CISA KEV entry.
Stored cross-site scripting in YITH WooCommerce Wishlist through 4.18.1 lets authenticated low-privileged users persist crafted input that executes in another user's browser when poisoned wishlist content is viewed. The plugin must be active alongside WooCommerce, and the attacker needs an account on the WordPress site, so exploitation depends on a victim, potentially an administrator, interacting with the stored payload. No public exploit identified at time of analysis; CVSS 6.5 reflects partial confidentiality, integrity, and availability impact with scope change.
Unauthenticated attackers can exploit a missing authorization flaw in YITH PayPal Express Checkout for WooCommerce (versions up to and including 1.61.0) to gain unauthorized access to limited sensitive information. Tracked as CVE-2026-111409 and classified as CWE-862, the vulnerability has a CVSS 3.1 base score of 5.3 due to a low confidentiality impact only (C:L/I:N/A:N). No public exploit code or confirmed active exploitation has been identified at time of analysis, but the plugin's default configuration exposes an unauthenticated endpoint.
Stored cross-site scripting in the YITH WooCommerce Compare plugin for WordPress (versions through 3.15.0) lets an authenticated low-privilege user persist malicious script that executes in the browser of any other user, including an administrator, who later views the affected page. The flaw is rated CVSS 6.5 (Medium) with vector AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L, meaning it is reachable over the network but requires a pre-existing low-privileged account and victim interaction, so it is not exploitable by a fully unauthenticated attacker against a default install. No public exploit code or confirmed active exploitation was identified at time of analysis.
Unauthenticated remote attackers can retrieve embedded sensitive system information from WordPress/WooCommerce sites running the YITH WooCommerce Product Add-Ons plugin through version 4.34.0. The flaw (CWE-497) is network-reachable with no privileges or user interaction required per the CVSS vector AV:N/AC:L/PR:N/UI:N, but the confidentiality impact is bounded (C:L), so exposure is limited to a specific set of sensitive data rather than a full site or database compromise, yielding a moderate CVSS 3.1 score of 5.3. No public exploit code or confirmed active exploitation was identified at time of analysis, and EPSS/KEV signals were not provided in the source data; risk is concentrated among unpatched sites with this plugin installed and active.
Missing authorization controls in the YITH WooCommerce Product Bundles plugin for WordPress (versions through 2.29.0) allow unauthenticated remote attackers to perform bundle-related actions they should not be permitted to perform on sites where the plugin is installed and active. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, base 5.3) confirms that no credentials or user interaction are required, but the impact is bounded to a low-integrity effect - there is no confidentiality or availability impact - and the store must actually run the affected plugin for exposure. At the time of analysis there is no vendor-released patch identified and no public exploit code identified; exploitation is limited to network reachability of the vulnerable endpoint on a WooCommerce store with the bundle feature enabled.
Authorization bypass through a user-controlled key (CWE-639 IDOR) in the YITH WooCommerce Request A Quote plugin for WordPress allows remote attackers to act on quote-request objects they should not control, on any site running a version before 4.46.1. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) confirms exploitation is remote, low complexity, unauthenticated and requires no user interaction, though damage is bounded to low integrity impact with no confidentiality or availability effect stated. No public exploit code identified at time of analysis, with no KEV or EPSS signals supplied, but the vendor has released a fixed version (4.46.1) and the issue was reported by Patchstack, so sites exposing the request-a-quote endpoints should treat patching as urgent housekeeping rather than a theoretical concern.
Cross-Site request forgery (CSRF) vulnerability in YITH YITH WooCommerce Product Slider Carousel allows Cross Site Request Forgery.16.0. Rated medium severity (CVSS 4.6), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Authorization bypass in YITH WooCommerce Wishlist through version 4.12.0 allows unauthenticated remote attackers to modify wishlist data via user-controlled object references, exploiting improper access control validation. The vulnerability enables integrity attacks against wishlist functionality without requiring authentication or user interaction, affecting all WordPress installations using the vulnerable plugin.
PHP Object Injection in YITH WooCommerce Affiliates through version 3.31.0 allows an authenticated attacker who already holds a high-privilege WordPress account to deserialize untrusted input and potentially achieve code execution or otherwise tamper with the site, with high impact to confidentiality, integrity, and availability (CVSS 7.2). The flaw is network-reachable without user interaction, but the PR:H requirement is the key limiter: unprivileged or unauthenticated users cannot reach the vulnerable deserialization path. No public exploit identified at time of analysis and no EPSS score was provided; the primary mitigations are reducing high-privilege accounts and applying a vendor fix once one ships.
Privilege escalation in YITH WooCommerce Waitlist Premium for WordPress (versions ≤3.35.0) allows any subscriber-level authenticated user to manufacture a new WordPress administrator account, achieving full site takeover. The vulnerable AJAX handler add_user_in_waiting_list() is exposed to all logged-in users with no nonce or capability check, and applies parse_str() plus extract() to attacker-supplied POST data before passing the injected variables directly to wp_create_user() and $user->set_role(). No public exploit code or CISA KEV listing has been identified at time of analysis, but the attack mechanics are trivially derivable from the Wordfence disclosure.
Missing authorization in the YITH Request a Quote for WooCommerce Premium plugin (all versions before 4.46.0) lets unauthenticated attackers reach functionality that should be access-controlled, per a Patchstack advisory. The flaw is a broken-access-control / missing-authorization issue (CWE-862) rated CVSS 9.8; no public exploit identified at time of analysis, though the advisory does not detail the exact vulnerable action.
SQL injection in YITH WooCommerce Membership Premium versions 2.33.0 and below allows authenticated subscribers to execute arbitrary SQL queries against the underlying database. Exploitation requires only a low-privilege WordPress subscriber account - the lowest registered user role - making the attack surface broad on any membership-enabled site. The CVSS scope change (S:C) and high confidentiality impact (C:H) indicate that successful exploitation can expose data beyond the plugin itself, including sensitive user and order records stored in the WordPress database. No public exploit code or active exploitation has been identified at time of analysis.
Blind SQL injection in YITH WooCommerce Product Add-Ons (WordPress plugin) through version 4.29.0 allows high-privileged authenticated users to inject malicious SQL into database queries, leading to confidentiality compromise and limited availability impact across a changed security scope. The flaw was disclosed by Patchstack and carries a CVSS 3.1 score of 7.6; no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Missing authorization in YITH PayPal Express Checkout for WooCommerce up to 1.62.0 lets unauthenticated remote attackers perform unauthorized actions that modify site data, with integrity-only impact (CVSS 5.3). No public exploit has been identified at time of analysis, and the flaw is limited to sites running this specific plugin with the vulnerable endpoint network-reachable.
Missing authorization in YITH WooCommerce Product Bundles through 2.29.0 lets unauthenticated remote attackers invoke access-controlled plugin functionality and perform a limited, low-integrity action on WordPress/WooCommerce sites running the plugin. The CVSS 3.1 score is 5.3 (AV:N/AC:L/PR:N/UI:N) with no confidentiality or availability impact; no public exploit was identified at time of analysis, and there is no CISA KEV entry.
Stored cross-site scripting in YITH WooCommerce Wishlist through 4.18.1 lets authenticated low-privileged users persist crafted input that executes in another user's browser when poisoned wishlist content is viewed. The plugin must be active alongside WooCommerce, and the attacker needs an account on the WordPress site, so exploitation depends on a victim, potentially an administrator, interacting with the stored payload. No public exploit identified at time of analysis; CVSS 6.5 reflects partial confidentiality, integrity, and availability impact with scope change.
Unauthenticated attackers can exploit a missing authorization flaw in YITH PayPal Express Checkout for WooCommerce (versions up to and including 1.61.0) to gain unauthorized access to limited sensitive information. Tracked as CVE-2026-111409 and classified as CWE-862, the vulnerability has a CVSS 3.1 base score of 5.3 due to a low confidentiality impact only (C:L/I:N/A:N). No public exploit code or confirmed active exploitation has been identified at time of analysis, but the plugin's default configuration exposes an unauthenticated endpoint.
Stored cross-site scripting in the YITH WooCommerce Compare plugin for WordPress (versions through 3.15.0) lets an authenticated low-privilege user persist malicious script that executes in the browser of any other user, including an administrator, who later views the affected page. The flaw is rated CVSS 6.5 (Medium) with vector AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L, meaning it is reachable over the network but requires a pre-existing low-privileged account and victim interaction, so it is not exploitable by a fully unauthenticated attacker against a default install. No public exploit code or confirmed active exploitation was identified at time of analysis.
Unauthenticated remote attackers can retrieve embedded sensitive system information from WordPress/WooCommerce sites running the YITH WooCommerce Product Add-Ons plugin through version 4.34.0. The flaw (CWE-497) is network-reachable with no privileges or user interaction required per the CVSS vector AV:N/AC:L/PR:N/UI:N, but the confidentiality impact is bounded (C:L), so exposure is limited to a specific set of sensitive data rather than a full site or database compromise, yielding a moderate CVSS 3.1 score of 5.3. No public exploit code or confirmed active exploitation was identified at time of analysis, and EPSS/KEV signals were not provided in the source data; risk is concentrated among unpatched sites with this plugin installed and active.
Missing authorization controls in the YITH WooCommerce Product Bundles plugin for WordPress (versions through 2.29.0) allow unauthenticated remote attackers to perform bundle-related actions they should not be permitted to perform on sites where the plugin is installed and active. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, base 5.3) confirms that no credentials or user interaction are required, but the impact is bounded to a low-integrity effect - there is no confidentiality or availability impact - and the store must actually run the affected plugin for exposure. At the time of analysis there is no vendor-released patch identified and no public exploit code identified; exploitation is limited to network reachability of the vulnerable endpoint on a WooCommerce store with the bundle feature enabled.
Authorization bypass through a user-controlled key (CWE-639 IDOR) in the YITH WooCommerce Request A Quote plugin for WordPress allows remote attackers to act on quote-request objects they should not control, on any site running a version before 4.46.1. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) confirms exploitation is remote, low complexity, unauthenticated and requires no user interaction, though damage is bounded to low integrity impact with no confidentiality or availability effect stated. No public exploit code identified at time of analysis, with no KEV or EPSS signals supplied, but the vendor has released a fixed version (4.46.1) and the issue was reported by Patchstack, so sites exposing the request-a-quote endpoints should treat patching as urgent housekeeping rather than a theoretical concern.
Cross-Site request forgery (CSRF) vulnerability in YITH YITH WooCommerce Product Slider Carousel allows Cross Site Request Forgery.16.0. Rated medium severity (CVSS 4.6), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Authorization bypass in YITH WooCommerce Wishlist through version 4.12.0 allows unauthenticated remote attackers to modify wishlist data via user-controlled object references, exploiting improper access control validation. The vulnerability enables integrity attacks against wishlist functionality without requiring authentication or user interaction, affecting all WordPress installations using the vulnerable plugin.