Threat database

Missing Authorization vulnerability in YITH YITH WooCommerce Product Bundles yith-woocommerce-product-bundles allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects YITH WooCommerce Product Bundles: from n/a through 2.29.0.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in YITH YITH WooCommerce Wishlist yith-woocommerce-wishlist allows Stored XSS.This issue affects YITH WooCommerce Wishlist: from n/a through 4.18.1.

CVE-2026-111409 is a missing authorization vulnerability in the YITH PayPal Express Checkout for WooCommerce plugin. This flaw allows unauthorized access due to incorrectly configured access control security levels. It affects versions from the initial release up to 1.61.0 inclusive. The vulnerability has a medium severity with a CVSS score of 5.3. No official patch or remediation information is provided in the available data.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in YITH YITH WooCommerce Compare yith-woocommerce-compare allows Stored XSS.This issue affects YITH WooCommerce Compare: from n/a through 3.15.0.

CVE-2026-66480 is a vulnerability in YITH WooCommerce Product Add-Ons that allows unauthorized exposure of sensitive system information. This issue affects versions up to and including 4.34.0. The vulnerability does not require privileges or user interaction to exploit and has a medium severity rating based on a CVSS score of 5.3.

CVE-2026-106606 is a deserialization of untrusted data vulnerability in the YITH WooCommerce Affiliates plugin. It allows object injection, potentially leading to complete compromise of confidentiality, integrity, and availability. The issue affects versions from initial releases up to 3.31.0. The vulnerability has a high severity score of 7.2 and requires high privileges to exploit. No known exploits are reported in the wild, and no patch information is provided in the source data.

Missing Authorization vulnerability in YITH YITH WooCommerce Product Bundles yith-woocommerce-product-bundles allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects YITH WooCommerce Product Bundles: from n/a through 2.29.0.

Author Cross Site Scripting (XSS) in YITH WooCommerce Tab Manager <= 2.15.0 versions.

Unauthenticated Cross Site Scripting (XSS) in YITH WooCommerce Ajax Search <= 2.28.0 versions.

Authorization Bypass Through User-Controlled Key vulnerability in YITH YITH WooCommerce Request A Quote allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects YITH WooCommerce Request A Quote: from n/a before 4.46.1.

Unauthenticated Broken Access Control in YITH Request a Quote for WooCommerce Premium < 4.46.0 versions.

CVE-2026-32552 is a high-severity SQL Injection vulnerability affecting YITH WooCommerce Membership Premium versions up to and including 2.33.0. This flaw allows an attacker with low privileges and no user interaction to execute SQL commands that can compromise confidentiality and cause limited availability impact. The vulnerability is identified as CWE-89, indicating improper neutralization of special elements in SQL commands.

CVE-2026-28169 is a medium severity vulnerability in YITH WooCommerce Zoom Magnifier versions up to and including 2.52.0. It allows unauthenticated attackers to expose sensitive system information. The vulnerability is classified under CWE-497, indicating exposure of sensitive system information to an unauthorized control sphere. No official patch or remediation guidance has been provided yet.

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in YITH YITH WooCommerce Product Add-Ons allows Blind SQL Injection. This issue affects YITH WooCommerce Product Add-Ons: from n/a through 4.29.0.

CVE-2026-27329 is a medium severity vulnerability in the YITH WooCommerce Wishlist plugin that allows authorization bypass through a user-controlled key. This issue arises from incorrectly configured access control security levels, potentially enabling unauthorized actions that impact integrity without affecting confidentiality or availability. The vulnerability affects versions up to 4.12.0. No official patch or remediation guidance is currently available from the vendor, and no known exploits are reported in the wild.

Deserialization of Untrusted Data vulnerability in YITHEMES YITH WooCommerce Compare yith-woocommerce-compare allows Object Injection.This issue affects YITH WooCommerce Compare: from n/a through <= 3.6.0.

Missing Authorization vulnerability in YITHEMES YITH WooCommerce Request A Quote yith-woocommerce-request-a-quote allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects YITH WooCommerce Request A Quote: from n/a through <= 2.46.0.

Missing Authorization vulnerability in YITHEMES YITH Slider for page builders yith-slider-for-page-builders allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects YITH Slider for page builders: from n/a through <= 1.0.11.

The YITH WooCommerce Quick View plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's yith_quick_view shortcode in all versions up to, and including, 2.7.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.