YITH Vulnerabilities and Affected Products
Vulnerabilities associated with YITH WooCommerce Product Add-Ons.
Products
Clear product- YITH WooCommerce Product Add-Ons3 vulnerabilities
- YITH Maintenance Mode (WordPress plugin)2 vulnerabilities
- WooCommerce Ajax Search Plugin for WordPress1 vulnerability
- YITH WooCommerce Account Funds Premium1 vulnerability
- YITH WooCommerce Ajax Product Filter1 vulnerability
- YITH WooCommerce Gift Cards1 vulnerability
- YITH WooCommerce Gift Cards Premium1 vulnerability
- YITH WooCommerce Product Slider Carousel1 vulnerability
- YITH WooCommerce Waiting List1 vulnerability
- YITH WooCommerce Wishlist1 vulnerability
- yith_woocommerce_gift_cards_premium1 vulnerability
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
CVE-2026-42383HIGH | WordPress YITH WooCommerce Product Add-Ons plugin <= 4.29.0 - SQL Injection vulnerabilityImproper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in YITH YITH WooCommerce Product Add-Ons allows Blind SQL Injection. This issue affects YITH WooCommerce Product Add-Ons: from n/a through 4.29.0. CWE-89May 20, 2026 | CVSS7.6v3.1 | EPSS0.289% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2024-27994HIGH | WordPress YITH WooCommerce Product Add-Ons plugin <= 4.5.0 - Cross Site Scripting (XSS) vulnerabilityImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in YITHEMES YITH WooCommerce Product Add-Ons yith-woocommerce-product-add-ons.This issue affects YITH WooCommerce Product Add-Ons: from n/a through <= 4.5.0. CWE-79Mar 21, 2024 | CVSS7.1v3.1 | EPSS0.398% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2023-49777CRITICAL | WordPress YITH WooCommerce Product Add-Ons Plugin <= 4.3.0 is vulnerable to PHP Object InjectionDeserialization of Untrusted Data vulnerability in YITH YITH WooCommerce Product Add-Ons.This issue affects YITH WooCommerce Product Add-Ons: from n/a through 4.3.0. CWE-502Dec 31, 2023 | CVSS9.1v3.1 | EPSS0.69% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |