Skip to content
OpenAdvisories

Vendor

Yith

24 known vulnerabilities.

Products

YITH WooCommerce Product Add-Ons 3 YITH PayPal Express Checkout for WooCommerce 2 YITH Maintenance Mode (WordPress plugin) 2 YITH WooCommerce Wishlist 2 YITH WooCommerce Product Bundles 2 YITH WooCommerce Affiliates 1 YITH WooCommerce Gift Cards Premium 1 YITH WooCommerce Product Slider Carousel 1 YITH WooCommerce Membership Premium 1 YITH WooCommerce Ajax Search 1 YITH WooCommerce Gift Cards 1 YITH Request a Quote for WooCommerce Premium 1 YITH WooCommerce Account Funds Premium 1 YITH WooCommerce Request A Quote 1 YITH WooCommerce Waiting List 1 YITH WooCommerce Subscription 1 YITH WooCommerce Waitlist Premium 1 YITH WooCommerce Compare 1
All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • High 7.2
    CVE-2026-106606

    WordPress YITH WooCommerce Affiliates plugin <= 3.31.0 - PHP Object Injection vulnerability

    Deserialization of Untrusted Data vulnerability in YITH YITH WooCommerce Affiliates yith-woocommerce-affiliates allows Object Injection.This issue affects YITH WooCommerce Affiliates: from n/a through 3.31.0.

    Yith YITH WooCommerce Affiliates Web / CMS
  • High 8.8
    CVE-2026-14359

    YITH WooCommerce Waitlist Premium <= 3.35.0 - Authenticated (Subscriber+) Privilege Escalation to Admin via wp_ajax_yith_wcwtl_add_user

    The YITH WooCommerce Waitlist Premium plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 3.35.0. This is due to the add_user_in_waiting_list() function registered on the wp_ajax_yith_wcwtl_add_user action being missin…

    Yith YITH WooCommerce Waitlist Premium Web / CMS
  • High 8.5
    CVE-2026-32552

    WordPress YITH WooCommerce Membership Premium plugin <= 2.33.0 - SQL Injection vulnerability

    Subscriber SQL Injection in YITH WooCommerce Membership Premium <= 2.33.0 versions.

    Yith YITH WooCommerce Membership Premium Web / CMS
  • High 7.6
    CVE-2026-42383

    WordPress YITH WooCommerce Product Add-Ons plugin <= 4.29.0 - SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in YITH YITH WooCommerce Product Add-Ons allows Blind SQL Injection. This issue affects YITH WooCommerce Product Add-Ons: from n/a through 4.29.0.

    Yith YITH WooCommerce Product Add-Ons Web / CMS