YITHEMES Vulnerabilities and Affected Products
Vulnerabilities associated with yith_woocommerce_gift_cards.
Products
Clear product- YITH WooCommerce Product Add-Ons5 vulnerabilities
- YITH WooCommerce Wishlist4 vulnerabilities
- YITH Custom Login2 vulnerabilities
- YITH WooCommerce Ajax Search2 vulnerabilities
- YITH WooCommerce Compare2 vulnerabilities
- yith_woocommerce_ajax_search2 vulnerabilities
- yith_woocommerce_gift_cards2 vulnerabilities
- YITH Essential Kit for WooCommerce #11 vulnerability
- YITH PayPal Express Checkout for WooCommerce1 vulnerability
- YITH Slider for page builders1 vulnerability
- YITH WooCommerce Ajax Product Filter1 vulnerability
- YITH WooCommerce Gift Cards1 vulnerability
- YITH WooCommerce Popup1 vulnerability
- YITH WooCommerce Quick View1 vulnerability
- YITH WooCommerce Request A Quote1 vulnerability
- YITH WooCommerce Tab Manager1 vulnerability
- YITH WooCommerce Zoom Magnifier1 vulnerability
- yith_woocommerce_account_funds_premium1 vulnerability
- yith_woocommerce_product_add-ons1 vulnerability
- yith_woocommerce_social_login1 vulnerability
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
CVE-2024-0870MEDIUM | YITH WooCommerce Gift Cards <= 4.12.0 - Missing Authorization to Unauthenticated WooCommerce Settings UpdateThe YITH WooCommerce Gift Cards plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'save_mail_status' and 'save_email_settings' functions in all versions up to, and including, 4.12.0. This makes it possible for unauthenticated attackers to modify WooCommerce settings. CWE-285May 14, 2024 | CVSS5.3v3.1 | EPSS0.504% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2022-45359CRITICAL | WordPress YITH WooCommerce Gift Cards Premium Plugin <= 3.19.0 is vulnerable to Arbitrary File UploadUnauth. Arbitrary File Upload vulnerability in YITH WooCommerce Gift Cards premium plugin <= 3.19.0 on WordPress. CWE-434Dec 6, 2022 | CVSS9.8v3.1 | EPSS13.5% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |