Yithemes
25 CVEs across 59 Yithemes products. Browse Yithemes vulnerabilities, severities, and proof-of-concept exploits.
Yithemes products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-28169 | Medium | 5.3 | 2026-08-06 | Unauthenticated Sensitive Data Exposure in YITH WooCommerce Zoom Magnifier <= 2.52.0 versions. |
CVE-2026-22333 | High | 7.2 | 2026-02-19 | Deserialization of Untrusted Data vulnerability in YITHEMES YITH WooCommerce Compare yith-woocommerce-compare allows Object Injection.This issue affects YITH W… |
CVE-2026-24366 | Medium | 5.3 | 2026-01-22 | Missing Authorization vulnerability in YITHEMES YITH WooCommerce Request A Quote yith-woocommerce-request-a-quote allows Exploiting Incorrectly Configured Acce… |
CVE-2025-68581 | Medium | 5.4 | 2025-12-24 | Missing Authorization vulnerability in YITHEMES YITH Slider for page builders yith-slider-for-page-builders allows Exploiting Incorrectly Configured Access Con… |
CVE-2025-8617 | Medium | 6.4 | 2025-12-13 | The YITH WooCommerce Quick View plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's yith_quick_view shortcode in all versions up… |
CVE-2025-12777 | Medium | 5.3 | 2025-11-19 | The YITH WooCommerce Wishlist plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.10.0. This is due to the plugi… |
CVE-2025-12427 | Medium | 5.3 | 2025-11-19 | The YITH WooCommerce Wishlist plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.10.0 via the REST… |
CVE-2025-54675 | Medium | 4.3 | 2025-08-14 | Cross-Site Request Forgery (CSRF) vulnerability in YITHEMES YITH WooCommerce Popup yith-woocommerce-popup allows Cross Site Request Forgery.This issue affects… |
CVE-2025-48111 | Medium | 4.3 | 2025-06-17 | Cross-Site Request Forgery (CSRF) vulnerability in YITHEMES YITH PayPal Express Checkout for WooCommerce allows Cross Site Request Forgery. This issue affects… |
CVE-2025-5238 | Medium | 6.4 | 2025-06-14 | The YITH WooCommerce Wishlist plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘id’ parameter in all versions up to, and including, 4… |
CVE-2023-46635 | Medium | 5.3 | 2025-01-02 | Missing Authorization vulnerability in YITHEMES YITH WooCommerce Product Add-Ons yith-woocommerce-product-add-ons allows Exploiting Incorrectly Configured Acce… |
CVE-2024-50448 | High | 7.1 | 2024-10-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in YITHEMES YITH WooCommerce Product Add-Ons yith-woocommerc… |
CVE-2024-47350 | Critical | 9.3 | 2024-10-06 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in YITHEMES YITH WooCommerce Ajax Search yith-woocommerce-aj… |
CVE-2024-47367 | High | 7.1 | 2024-10-06 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in YITHEMES YITH WooCommerce Product Add-Ons yith-woocommerc… |
CVE-2024-7846 | Medium | 5.4 | 2024-09-23 | YITH WooCommerce Ajax Search is vulnerable to a XSS vulnerability due to insufficient sanitization of user supplied block attributes. This makes it possible fo… |
CVE-2024-8665 | Medium | 6.1 | 2024-09-13 | The YITH Custom Login plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the… |
CVE-2024-37943 | Medium | 5.8 | 2024-07-20 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in YITHEMES YITH WooCommerce Ajax Product Filter yith-woocom… |
CVE-2024-6799 | Medium | 4.3 | 2024-07-19 | The YITH Essential Kit for WooCommerce #1 plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'act… |
CVE-2024-35680 | Medium | 5.3 | 2024-06-10 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in YITHEMES YITH WooCommerce Product Add-Ons yith-woocommerce-produ… |
CVE-2024-30470 | Medium | 6.5 | 2024-06-09 | Missing Authorization vulnerability in YITH YITH WooCommerce Account Funds Premium.This issue affects YITH WooCommerce Account Funds Premium: from n/a through… |
CVE-2024-35698 | Medium | 5.9 | 2024-06-08 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in YITHEMES YITH WooCommerce Tab Manager yith-woocommerce-ta… |
CVE-2024-35732 | Medium | 5.9 | 2024-06-08 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in YITHEMES YITH Custom Login yith-custom-login.This issue a… |
CVE-2024-34385 | Medium | 5.9 | 2024-06-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in YITHEMES YITH WooCommerce Wishlist yith-woocommerce-wishl… |
CVE-2024-4455 | High | 7.2 | 2024-05-24 | The YITH WooCommerce Ajax Search plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘item’ parameter in versions up to, and including, 2… |
CVE-2024-0870 | Medium | 5.3 | 2024-05-14 | The YITH WooCommerce Gift Cards plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'save_mail_sta… |
CVE-2024-32699 | Medium | 4.3 | 2024-04-24 | Cross-Site Request Forgery (CSRF) vulnerability in YITHEMES YITH WooCommerce Compare yith-woocommerce-compare.This issue affects YITH WooCommerce Compare: from… |
CVE-2024-27994 | High | 7.1 | 2024-03-21 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in YITHEMES YITH WooCommerce Product Add-Ons yith-woocommerc… |
CVE-2023-49777 | Critical | 9.1 | 2023-12-31 | Deserialization of Untrusted Data vulnerability in YITH YITH WooCommerce Product Add-Ons.This issue affects YITH WooCommerce Product Add-Ons: from n/a through… |
CVE-2022-45359 | Critical | 9.8 | 2022-12-06 | Unauth. Arbitrary File Upload vulnerability in YITH WooCommerce Gift Cards premium plugin <= 3.19.0 on WordPress. |
CVE-2022-0818 | Medium | 6.1 | 2022-03-28 | The WooCommerce Affiliate Plugin WordPress plugin before 4.16.4.5 does not have authorization and CSRF checks on a specific action handler, as well as does not… |
CVE-2021-36845 | Medium | 6.9 | 2021-09-27 | Multiple Authenticated Stored Cross-Site Scripting (XSS) vulnerabilities in YITH Maintenance Mode (WordPress plugin) versions <= 1.3.8, there are 46 vulnerable… |
CVE-2021-36841 | Medium | 6.9 | 2021-09-27 | Authenticated Stored Cross-Site Scripting (XSS) vulnerability in YITH Maintenance Mode (WordPress plugin) versions <= 1.3.7, vulnerable parameter &yith_mainten… |
CVE-2021-3120 | Critical | 9.8 | 2021-02-22 | An arbitrary file upload vulnerability in the YITH WooCommerce Gift Cards Premium plugin before 3.3.1 for WordPress allows remote attackers to achieve remote c… |
CVE-2019-16251 | Medium | 4.3 | 2019-10-31 | plugin-fw/lib/yit-plugin-panel-wc.php in the YIT Plugin Framework through 3.3.8 for WordPress allows authenticated options changes. |
CVE-2015-9429 | Medium | 6.5 | 2019-09-26 | The yith-maintenance-mode plugin before 1.2.0 for WordPress has CSRF with resultant XSS via the wp-admin/themes.php?page=yith-maintenance-mode panel_page param… |