Skip to content
OpenAdvisories

Vendor

Yith

23 known vulnerabilities.

Yith at a glance

Last 12 months
16
Critical · all time
3
Exploited · all time
0
Public exploit · all time
0
New vulnerabilities per month · last 12 months
0 5 10 December 2025: 0 vulnerabilities Dec 2025 January 2026: 0 vulnerabilities February 2026: 0 vulnerabilities March 2026: 0 vulnerabilities Mar April 2026: 0 vulnerabilities May 2026: 2 vulnerabilities June 2026: 1 vulnerability Jun July 2026: 0 vulnerabilities August 2026: 1 vulnerability September 2026: 3 vulnerabilities, 1 critical Sep October 2026: 8 vulnerabilities November 2026: 1 vulnerability
Show as table
MonthVulnerabilitiesCritical
Nov 202610
Oct 202680
Sep 202631
Aug 202610
Jul 202600
Jun 202610
May 202620
Apr 202600
Mar 202600
Feb 202600
Jan 202600
Dec 202500
Nov 202500
Oct 202500
Sep 202500
Aug 202500
Jul 202500
Jun 202500
May 202500
Apr 202500
Mar 202500
Feb 202500
Jan 202500
Dec 202410

Products

YITH WooCommerce Product Add-Ons 3 YITH PayPal Express Checkout for WooCommerce 2 YITH Maintenance Mode (WordPress plugin) 2 YITH WooCommerce Wishlist 2 YITH WooCommerce Product Bundles 2 YITH WooCommerce Affiliates 1 YITH WooCommerce Gift Cards Premium 1 YITH WooCommerce Product Slider Carousel 1 YITH WooCommerce Membership Premium 1 YITH WooCommerce Gift Cards 1 YITH Request a Quote for WooCommerce Premium 1 YITH WooCommerce Account Funds Premium 1 YITH WooCommerce Request A Quote 1 YITH WooCommerce Waiting List 1 YITH WooCommerce Subscription 1 YITH WooCommerce Waitlist Premium 1 YITH WooCommerce Compare 1
All Critical High Medium Low Exploited only Public exploit

23 results · Feed

  • Medium 5.3
    CVE-2026-121779

    WordPress YITH WooCommerce Subscription plugin <= 4.22.0 - Sensitive Data Exposure vulnerability

    Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in YITH YITH WooCommerce Subscription yith-woocommerce-subscription allows Retrieve Embedded Sensitive Data.This issue affects YITH WooCommerce Subscription: from n/a thr…

    Yith YITH WooCommerce Subscription Web / CMS
  • Medium 5.3
    CVE-2026-27401

    WordPress YITH PayPal Express Checkout for WooCommerce plugin <= 1.62.0 - Broken Access Control vulnerability

    Missing Authorization vulnerability in YITH YITH PayPal Express Checkout for WooCommerce yith-paypal-express-checkout-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects YITH PayPal Express Checkout for W…

    Yith YITH PayPal Express Checkout for WooCommerce Web / CMS
  • Medium 5.3
    CVE-2026-111845

    WordPress YITH WooCommerce Product Bundles plugin <= 2.29.0 - Broken Access Control vulnerability

    Missing Authorization vulnerability in YITH YITH WooCommerce Product Bundles yith-woocommerce-product-bundles allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects YITH WooCommerce Product Bundles: from n/a through 2.29.0.

    Yith YITH WooCommerce Product Bundles Web / CMS
  • Medium 6.5
    CVE-2026-112199

    WordPress YITH WooCommerce Wishlist plugin <= 4.18.1 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in YITH YITH WooCommerce Wishlist yith-woocommerce-wishlist allows Stored XSS.This issue affects YITH WooCommerce Wishlist: from n/a through 4.18.1.

    Yith YITH WooCommerce Wishlist Web / CMS
  • Medium 5.3
    CVE-2026-111409

    WordPress YITH PayPal Express Checkout for WooCommerce plugin <= 1.61.0 - Broken Access Control vulnerability

    Missing Authorization vulnerability in YITH YITH PayPal Express Checkout for WooCommerce yith-paypal-express-checkout-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects YITH PayPal Express Checkout for W…

    Yith YITH PayPal Express Checkout for WooCommerce Web / CMS
  • Medium 6.5
    CVE-2026-106604

    WordPress YITH WooCommerce Compare plugin <= 3.15.0 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in YITH YITH WooCommerce Compare yith-woocommerce-compare allows Stored XSS.This issue affects YITH WooCommerce Compare: from n/a through 3.15.0.

    Yith YITH WooCommerce Compare Web / CMS
  • Medium 5.3
    CVE-2026-66480

    WordPress YITH WooCommerce Product Add-Ons plugin <= 4.34.0 - Sensitive Data Exposure vulnerability

    Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in YITH YITH WooCommerce Product Add-Ons allows Retrieve Embedded Sensitive Data. This issue affects YITH WooCommerce Product Add-Ons: from n/a through 4.34.0.

    Yith YITH WooCommerce Product Add-Ons Web / CMS
  • High 7.2
    CVE-2026-106606

    WordPress YITH WooCommerce Affiliates plugin <= 3.31.0 - PHP Object Injection vulnerability

    Deserialization of Untrusted Data vulnerability in YITH YITH WooCommerce Affiliates yith-woocommerce-affiliates allows Object Injection.This issue affects YITH WooCommerce Affiliates: from n/a through 3.31.0.

    Yith YITH WooCommerce Affiliates Web / CMS
  • Medium 5.3
    CVE-2026-105878

    WordPress YITH WooCommerce Product Bundles plugin <= 2.29.0 - Broken Access Control vulnerability

    Missing Authorization vulnerability in YITH YITH WooCommerce Product Bundles yith-woocommerce-product-bundles allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects YITH WooCommerce Product Bundles: from n/a through 2.29.0.

    Yith YITH WooCommerce Product Bundles Web / CMS
  • Medium 6.5
    CVE-2026-95602

    WordPress YITH WooCommerce Request A Quote plugin < 4.46.1 - Insecure Direct Object References (IDOR) vulnerability

    Authorization Bypass Through User-Controlled Key vulnerability in YITH YITH WooCommerce Request A Quote allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects YITH WooCommerce Request A Quote: from n/a before 4.46.1.

    Yith YITH WooCommerce Request A Quote Web / CMS
  • High 8.8
    CVE-2026-14359

    YITH WooCommerce Waitlist Premium <= 3.35.0 - Authenticated (Subscriber+) Privilege Escalation to Admin via wp_ajax_yith_wcwtl_add_user

    The YITH WooCommerce Waitlist Premium plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 3.35.0. This is due to the add_user_in_waiting_list() function registered on the wp_ajax_yith_wcwtl_add_user action being missin…

    Yith YITH WooCommerce Waitlist Premium Web / CMS
  • Critical 9.8
    CVE-2026-84238

    WordPress YITH Request a Quote for WooCommerce Premium plugin < 4.46.0 - Broken Access Control vulnerability

    Unauthenticated Broken Access Control in YITH Request a Quote for WooCommerce Premium < 4.46.0 versions.

    Yith YITH Request a Quote for WooCommerce Premium Web / CMS
  • High 8.5
    CVE-2026-32552

    WordPress YITH WooCommerce Membership Premium plugin <= 2.33.0 - SQL Injection vulnerability

    Subscriber SQL Injection in YITH WooCommerce Membership Premium <= 2.33.0 versions.

    Yith YITH WooCommerce Membership Premium Web / CMS
  • Medium 4.6
    CVE-2022-44630

    WordPress YITH WooCommerce Product Slider Carousel plugin <= 1.16.0 - Cross-Site Request Forgery (CSRF)

    Cross-Site request forgery (CSRF) vulnerability in YITH YITH WooCommerce Product Slider Carousel allows Cross Site Request Forgery. This issue affects YITH WooCommerce Product Slider Carousel: from n/a through 1.16.0.

    Yith YITH WooCommerce Product Slider Carousel Web / CMS
  • High 7.6
    CVE-2026-42383

    WordPress YITH WooCommerce Product Add-Ons plugin <= 4.29.0 - SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in YITH YITH WooCommerce Product Add-Ons allows Blind SQL Injection. This issue affects YITH WooCommerce Product Add-Ons: from n/a through 4.29.0.

    Yith YITH WooCommerce Product Add-Ons Web / CMS
  • Medium 5.3
    CVE-2026-27329

    WordPress YITH WooCommerce Wishlist plugin <= 4.12.0 - Insecure Direct Object References (IDOR) vulnerability

    Authorization Bypass Through User-Controlled Key vulnerability in YITH YITH WooCommerce Wishlist allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects YITH WooCommerce Wishlist: from n/a through 4.12.0.

    Yith YITH WooCommerce Wishlist Web / CMS
  • Medium 5.3
    CVE-2023-36506

    WordPress YITH WooCommerce Waitlist plugin <= 2.13.0 - Broken Access Control vulnerability

    Missing Authorization vulnerability in YITH YITH WooCommerce Waiting List allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects YITH WooCommerce Waiting List: from n/a through 2.13.0.

    Yith YITH WooCommerce Waiting List Web / CMS
  • Medium 6.5
    CVE-2024-30470

    WordPress YITH WooCommerce Account Funds Premium plugin <= 1.32.0 - Broken Access Control vulnerability

    Missing Authorization vulnerability in YITH YITH WooCommerce Account Funds Premium.This issue affects YITH WooCommerce Account Funds Premium: from n/a through 1.33.0.

    Yith YITH WooCommerce Account Funds Premium Web / CMS
  • Medium 6.5
    CVE-2022-44633

    WordPress YITH WooCommerce Gift Cards Premium plugin <= 3.23.1 - Unauth. Gift Card Creation Leading to Stored XSS vulnerability

    Missing Authorization vulnerability in YITH YITH WooCommerce Gift Cards Premium.This issue affects YITH WooCommerce Gift Cards Premium: from n/a through 3.23.1.

    Yith YITH WooCommerce Gift Cards Premium Web / CMS
  • Critical 9.1
    CVE-2023-49777

    WordPress YITH WooCommerce Product Add-Ons Plugin <= 4.3.0 is vulnerable to PHP Object Injection

    Deserialization of Untrusted Data vulnerability in YITH YITH WooCommerce Product Add-Ons.This issue affects YITH WooCommerce Product Add-Ons: from n/a through 4.3.0.

    Yith YITH WooCommerce Product Add-Ons Web / CMS
  • Critical 9.8
    CVE-2022-45359 EPSS 14%

    WordPress YITH WooCommerce Gift Cards Premium Plugin <= 3.19.0 is vulnerable to Arbitrary File Upload

    Unauth. Arbitrary File Upload vulnerability in YITH WooCommerce Gift Cards premium plugin <= 3.19.0 on WordPress.

    Yith YITH WooCommerce Gift Cards Web / CMS
  • Medium 6.9
    CVE-2021-36845

    YITH Maintenance Mode (WordPress plugin) <= 1.3.8 - Multiple Authenticated Stored Cross-Site Scripting (XSS) vulnerabilities

    Multiple Authenticated Stored Cross-Site Scripting (XSS) vulnerabilities in YITH Maintenance Mode (WordPress plugin) versions <= 1.3.8, there are 46 vulnerable parameters that were missed by the vendor while patching the 1.3.7 version to 1.3.8. Vulnerable par…

    Yith YITH Maintenance Mode (WordPress plugin) Web / CMS
  • Medium 6.9
    CVE-2021-36841

    YITH Maintenance Mode (WordPress plugin) <= 1.3.7 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability.

    Authenticated Stored Cross-Site Scripting (XSS) vulnerability in YITH Maintenance Mode (WordPress plugin) versions <= 1.3.7, vulnerable parameter &yith_maintenance_newsletter_submit_label. Possible even when unfiltered HTML is disallowed by WordPress configur…

    Yith YITH Maintenance Mode (WordPress plugin) Web / CMS