Yith Woocommerce Product Add Ons
Monthly
Blind SQL injection in YITH WooCommerce Product Add-Ons (WordPress plugin) through version 4.29.0 allows high-privileged authenticated users to inject malicious SQL into database queries, leading to confidentiality compromise and limited availability impact across a changed security scope. The flaw was disclosed by Patchstack and carries a CVSS 3.1 score of 7.6; no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
An unauthenticated authorization bypass in the WordPress plugin YITH WooCommerce Product Add-Ons through version 4.34.0 can let remote attackers use a user-controlled key to bypass an access-control decision, with limited integrity impact and no confidentiality or availability impact (CVSS 5.3). The supplied intelligence shows no public exploit identified at time of analysis and no CISA KEV confirmation, and the vuln.today priority is this_month rather than an emergency.
Unauthenticated remote attackers can retrieve embedded sensitive system information from WordPress/WooCommerce sites running the YITH WooCommerce Product Add-Ons plugin through version 4.34.0. The flaw (CWE-497) is network-reachable with no privileges or user interaction required per the CVSS vector AV:N/AC:L/PR:N/UI:N, but the confidentiality impact is bounded (C:L), so exposure is limited to a specific set of sensitive data rather than a full site or database compromise, yielding a moderate CVSS 3.1 score of 5.3. No public exploit code or confirmed active exploitation was identified at time of analysis, and EPSS/KEV signals were not provided in the source data; risk is concentrated among unpatched sites with this plugin installed and active.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in YITHEMES YITH WooCommerce Product Add-Ons yith-woocommerce-product-add-ons.14.1. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in YITHEMES YITH WooCommerce Product Add-Ons yith-woocommerce-product-add-ons.9.2. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Deserialization of Untrusted Data vulnerability in YITH YITH WooCommerce Product Add-Ons.3.0. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
plugin-fw/lib/yit-plugin-panel-wc.php in the YIT Plugin Framework through 3.3.8 for WordPress allows authenticated options changes. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Blind SQL injection in YITH WooCommerce Product Add-Ons (WordPress plugin) through version 4.29.0 allows high-privileged authenticated users to inject malicious SQL into database queries, leading to confidentiality compromise and limited availability impact across a changed security scope. The flaw was disclosed by Patchstack and carries a CVSS 3.1 score of 7.6; no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
An unauthenticated authorization bypass in the WordPress plugin YITH WooCommerce Product Add-Ons through version 4.34.0 can let remote attackers use a user-controlled key to bypass an access-control decision, with limited integrity impact and no confidentiality or availability impact (CVSS 5.3). The supplied intelligence shows no public exploit identified at time of analysis and no CISA KEV confirmation, and the vuln.today priority is this_month rather than an emergency.
Unauthenticated remote attackers can retrieve embedded sensitive system information from WordPress/WooCommerce sites running the YITH WooCommerce Product Add-Ons plugin through version 4.34.0. The flaw (CWE-497) is network-reachable with no privileges or user interaction required per the CVSS vector AV:N/AC:L/PR:N/UI:N, but the confidentiality impact is bounded (C:L), so exposure is limited to a specific set of sensitive data rather than a full site or database compromise, yielding a moderate CVSS 3.1 score of 5.3. No public exploit code or confirmed active exploitation was identified at time of analysis, and EPSS/KEV signals were not provided in the source data; risk is concentrated among unpatched sites with this plugin installed and active.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in YITHEMES YITH WooCommerce Product Add-Ons yith-woocommerce-product-add-ons.14.1. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in YITHEMES YITH WooCommerce Product Add-Ons yith-woocommerce-product-add-ons.9.2. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Deserialization of Untrusted Data vulnerability in YITH YITH WooCommerce Product Add-Ons.3.0. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
plugin-fw/lib/yit-plugin-panel-wc.php in the YIT Plugin Framework through 3.3.8 for WordPress allows authenticated options changes. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.