CVEs we hold for Yithemes
Records whose assigning authority named Yithemes as the affected vendor. Newest identifiers first, capped at 200.
CVE-2026-28169WordPress YITH WooCommerce Zoom Magnifier plugin <= 2.52.0 - Sensitive Data Exposure vulnerabilityYITHEMES YITH WooCommerce Zoom Magnifier
CVE-2026-24366WordPress YITH WooCommerce Request A Quote plugin <= 2.46.0 - Broken Access Control vulnerabilityYITHEMES YITH WooCommerce Request A Quote
CVE-2026-22333WordPress YITH WooCommerce Compare plugin <= 3.6.0 - Deserialization of untrusted data vulnerabilityYITHEMES YITH WooCommerce Compare
CVE-2025-8617YITH WooCommerce Quick View <= 2.7.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via yith_quick_view…yithemes YITH WooCommerce Quick View
CVE-2025-68581WordPress YITH Slider for page builders plugin <= 1.0.11 - Broken Access Control vulnerabilityYITHEMES YITH Slider for page builders
CVE-2025-54675WordPress YITH WooCommerce Popup Plugin plugin <= 1.48.0 - Cross Site Request Forgery (CSRF) VulnerabilityYITHEMES YITH WooCommerce Popup
CVE-2025-5238YITH WooCommerce Wishlist <= 4.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameteryithemes YITH WooCommerce Wishlist
CVE-2025-48111WordPress YITH PayPal Express Checkout for WooCommerce plugin <= 1.49.0 - Cross Site Request Forgery (CSRF)…YITHEMES YITH PayPal Express Checkout for WooCommerce
CVE-2025-12777YITH WooCommerce Wishlist <= 4.10.0 - Unauthenticated Wishlist Token Disclosure to Wishlist Item Deletionyithemes YITH WooCommerce Wishlist
CVE-2025-12427YITH WooCommerce Wishlist <= 4.10.0 - Unauthenticated Insecure Direct Object Reference to Unauthenticated Wishlist…yithemes YITH WooCommerce Wishlist
CVE-2024-6799YITH Essential Kit for WooCommerce #1 <= 2.34.0 - Missing Authorization to Authenticated (Subscriber+) Limited Plugin…yithemes YITH Essential Kit for WooCommerce #1
CVE-2024-50448WordPress YITH WooCommerce Product Add-Ons plugin <= 4.14.1 - Reflected Cross Site Scripting (XSS) vulnerabilityYITHEMES YITH WooCommerce Product Add-Ons
CVE-2024-47367WordPress YITH WooCommerce Product Add-Ons plugin <= 4.13.0 - Reflected Cross Site Scripting (XSS) vulnerabilityYITHEMES YITH WooCommerce Product Add-Ons
CVE-2024-47350WordPress YITH WooCommerce Ajax Search plugin <= 2.8.0 - SQL Injection vulnerabilityYITHEMES YITH WooCommerce Ajax Search
CVE-2024-4455YITH WooCommerce Ajax Search <= 2.4.0 - Unauthenticated Stored Cross-Site Scriptingyithemes YITH WooCommerce Ajax Search
CVE-2024-37943WordPress YITH WooCommerce Ajax Product Filter plugin <= 5.1.0 - Reflected Cross Site Scripting (XSS) vulnerabilityYITHEMES YITH WooCommerce Ajax Product Filter
CVE-2024-35732WordPress YITH Custom Login plugin <= 1.7.0 - Cross Site Scripting (XSS) vulnerabilityYITHEMES YITH Custom Login
CVE-2024-35698WordPress YITH WooCommerce Tab Manager plugin <= 1.35.0 - Cross Site Scripting (XSS) vulnerabilityYITHEMES YITH WooCommerce Tab Manager
CVE-2024-35680WordPress YITH WooCommerce Product Add-Ons plugin <= 4.9.2 - Content Injection vulnerabilityYITHEMES YITH WooCommerce Product Add-Ons
CVE-2024-34385WordPress YITH WooCommerce Wishlist plugin <= 3.32.0 - Cross Site Scripting (XSS) vulnerabilityYITHEMES YITH WooCommerce Wishlist
CVE-2024-32699WordPress YITH WooCommerce Compare plugin <= 2.37.0 - Cross Site Request Forgery (CSRF) vulnerabilityYITHEMES YITH WooCommerce Compare
CVE-2024-27994WordPress YITH WooCommerce Product Add-Ons plugin <= 4.5.0 - Cross Site Scripting (XSS) vulnerabilityYITHEMES YITH WooCommerce Product Add-Ons
CVE-2024-0870YITH WooCommerce Gift Cards <= 4.12.0 - Missing Authorization to Unauthenticated WooCommerce Settings Updateyithemes YITH WooCommerce Gift Cards
CVE-2023-46635WordPress YITH WooCommerce Product Add-Ons plugin <= 4.2.0 - Broken Access Control vulnerabilityYITHEMES YITH WooCommerce Product Add-Ons
25 records, read from the index as it stood on 20 Sep 2026. Every row opens the record it names, and every value on that record opens its own receipt.
Everything on this page is free. Public data. Withholding it protects nothing.