YITH
Vulnerability activity for YITH: what is being exploited, what was published lately, and when the next patch release is due.
Last 30 days
- CVEs
- 8
- Critical (CVSS 9+)
- 0
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Last 90 days
- CVEs
- 11
- Critical (CVSS 9+)
- 1
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Last 365 days
- CVEs
- 11
- Critical (CVSS 9+)
- 1
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Exploited now
None of this vendor's CVEs are on CISA's known-exploited list.
Recent
- 5.3MediumOct 29, 2026YITH PayPal Express Checkout for WooCommerce Auth bypass / access controlCVE-2026-27401Missing Authorization vulnerability in YITH YITH PayPal Express Checkout for WooCommerce yith-paypal-express-checkout-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects YITH PayPal Express Checkout for WooCommerce: from n/a through 1.62.0.
- 6.5MediumOct 19, 2026YITH WooCommerce Wishlist XSSCVE-2026-112199Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in YITH YITH WooCommerce Wishlist yith-woocommerce-wishlist allows Stored XSS.This issue affects YITH WooCommerce Wishlist: from n/a through 4.18.1.
- 5.3MediumOct 19, 2026YITH WooCommerce Product Bundles Auth bypass / access controlCVE-2026-111845Missing Authorization vulnerability in YITH YITH WooCommerce Product Bundles yith-woocommerce-product-bundles allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects YITH WooCommerce Product Bundles: from n/a through 2.29.0.
- 5.3MediumOct 16, 2026YITH PayPal Express Checkout for WooCommerce Auth bypass / access controlCVE-2026-111409Missing Authorization vulnerability in YITH YITH PayPal Express Checkout for WooCommerce yith-paypal-express-checkout-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects YITH PayPal Express Checkout for WooCommerce: from n/a through 1.61.0.
- 6.5MediumOct 15, 2026YITH WooCommerce Compare XSSCVE-2026-106604Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in YITH YITH WooCommerce Compare yith-woocommerce-compare allows Stored XSS.This issue affects YITH WooCommerce Compare: from n/a through 3.15.0.
- 5.3MediumOct 10, 2026YITH WooCommerce Product Add-Ons Information disclosureCVE-2026-66480Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in YITH YITH WooCommerce Product Add-Ons allows Retrieve Embedded Sensitive Data. This issue affects YITH WooCommerce Product Add-Ons: from n/a through 4.34.0.
- 7.2HighOct 10, 2026YITH WooCommerce Affiliates DeserializationCVE-2026-106606Deserialization of Untrusted Data vulnerability in YITH YITH WooCommerce Affiliates yith-woocommerce-affiliates allows Object Injection.This issue affects YITH WooCommerce Affiliates: from n/a through 3.31.0.
- 5.3MediumOct 8, 2026YITH WooCommerce Product Bundles Auth bypass / access controlCVE-2026-105878Missing Authorization vulnerability in YITH YITH WooCommerce Product Bundles yith-woocommerce-product-bundles allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects YITH WooCommerce Product Bundles: from n/a through 2.29.0.
- 6.5MediumSep 23, 2026YITH WooCommerce Request A Quote Auth bypass / access controlCVE-2026-95602Authorization Bypass Through User-Controlled Key vulnerability in YITH YITH WooCommerce Request A Quote allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects YITH WooCommerce Request A Quote: from n/a before 4.46.1.
- 8.8HighSep 9, 2026YITH WooCommerce Waitlist Premium Privilege escalationCVE-2026-14359The YITH WooCommerce Waitlist Premium plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 3.35.0. This is due to the add_user_in_waiting_list() function registered on the wp_ajax_yith_wcwtl_add_user action being missing both a capability check and a nonce verification, and using parse_str() + extract() to import attacker-controlled variables from $_POST['params'] that are then passed to wp_create_user() and $user->set_role(). This makes it possible for au
- 9.8CriticalSep 3, 2026YITH Request a Quote for WooCommerce Premium Auth bypass / access controlCVE-2026-84238Unauthenticated Broken Access Control in YITH Request a Quote for WooCommerce Premium < 4.46.0 versions.
Top products
- YITH WooCommerce Product Bundles2 CVEs in the last year
- YITH PayPal Express Checkout for WooCommerce2 CVEs in the last year
- YITH WooCommerce Wishlist1 CVE in the last year
- YITH WooCommerce Waitlist Premium1 CVE in the last year
- YITH WooCommerce Request A Quote1 CVE in the last year
- YITH WooCommerce Product Add-Ons1 CVE in the last year
- YITH WooCommerce Compare1 CVE in the last year
- YITH WooCommerce Affiliates1 CVE in the last year
- YITH Request a Quote for WooCommerce Premium1 CVE in the last year, 1 critical
Counts cover CVEs and advisories Watch Floor tracks, by the date they became news. Updated every 10 minutes.