401 matches found
YITH WooCommerce Ajax Search <= 2.4.0 - Cross-Site Scripting
The YITH WooCommerce Ajax Search plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'queryString' parameter in the REST API endpoint /ywcas/v1/register in versions up to, and including, 2.4.0 due to insufficient input sanitization and output escaping. id: CVE-2024-4455 info...
CVE-2026-82305
The YITH WooCommerce Wishlist WordPress plugin before 4.18.1 does not verify that a user is authorised to rename a given wishlist, allowing unauthenticated users to rename any wishlist on the site...
CVE-2026-82305
The YITH WooCommerce Wishlist WordPress plugin (versions before 4.18.1 ) contains an authorization bypass in the change_wishlist_title function, which fails to verify that a user is permitted to rename a given wishlist. This allows unauthenticated attackers to rename any wishlist on the site, res...
CVE-2026-82305 YITH WooCommerce Wishlist < 4.18.1 - Unauthenticated Arbitrary Wishlist Rename via change_wishlist_title
The YITH WooCommerce Wishlist WordPress plugin before 4.18.1 does not verify that a user is authorised to rename a given wishlist, allowing unauthenticated users to rename any wishlist on the site...
EUVD-2026-75965
The YITH WooCommerce Wishlist WordPress plugin before 4.18.1 does not verify that a user is authorised to rename a given wishlist, allowing unauthenticated users to rename any wishlist on the site...
WordPress YITH WooCommerce Wishlist plugin < 4.18.1 - Unauthenticated Arbitrary Wishlist Rename vulnerability
Unauthenticated Arbitrary Wishlist Rename vulnerability discovered by Abdullah Kareem in WordPress Plugin YITH WooCommerce Wishlist versions 4.18.1...
CVE-2026-14359
The YITH WooCommerce Waitlist Premium plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 3.35.0. This is due to the adduserinwaitinglist function registered on the wpajaxyithwcwtladduser action being missing both a capability check and a nonce verificatio...
EUVD-2026-74774
The YITH WooCommerce Waitlist Premium plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 3.35.0. This is due to the adduserinwaitinglist function registered on the wpajaxyithwcwtladduser action being missing both a capability check and a nonce verificatio...
CVE-2026-14359
The YITH WooCommerce Waitlist Premium WordPress plugin (versions ≤ 3.35.0 ) contains an authenticated Privilege Escalation to Administrator vulnerability discovered by Michele Genito. The root cause lies in the add_user_in_waiting_list() function, registered on the wp_ajax_yith_wcwtl_add_user act...
CVE-2026-14359 YITH WooCommerce Waitlist Premium <= 3.35.0 - Authenticated (Subscriber+) Privilege Escalation to Admin via wp_ajax_yith_wcwtl_add_user
The YITH WooCommerce Waitlist Premium plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 3.35.0. This is due to the adduserinwaitinglist function registered on the wpajaxyithwcwtladduser action being missing both a capability check and a nonce verificatio...
WordPress YITH WooCommerce Waitlist Premium plugin <= 3.35.0 - Authenticated (Subscriber+) Privilege Escalation to Admin vulnerability
Authenticated Subscriber+ Privilege Escalation to Admin vulnerability discovered by Michele Genito in WordPress Plugin YITH WooCommerce Waitlist Premium versions = 3.35.0...
CVE-2026-84238
Unauthenticated Broken Access Control in YITH Request a Quote for WooCommerce Premium 4.46.0 versions...
CVE-2026-84238
CVE-2026-84238 affects the YITH Request a Quote for WooCommerce Premium WordPress plugin in versions prior to 4.46.0 . The vulnerability is an unauthenticated Broken Access Control flaw, meaning an attacker can exploit it over the network without any prior access or user interaction. The CVSS 3.1...
EUVD-2026-70563
Unauthenticated Broken Access Control in YITH Request a Quote for WooCommerce Premium 4.46.0 versions...
CVE-2026-84238 WordPress YITH Request a Quote for WooCommerce Premium plugin < 4.46.0 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in YITH Request a Quote for WooCommerce Premium 4.46.0 versions...
WordPress YITH Request a Quote for WooCommerce Premium plugin < 4.46.0 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Jorgson in WordPress Plugin YITH Request a Quote for WooCommerce Premium versions 4.46.0...
CVE-2026-32552
Subscriber SQL Injection in YITH WooCommerce Membership Premium = 2.33.0 versions...
CVE-2026-32552
A SQL Injection vulnerability exists in the YITH WooCommerce Membership Premium WordPress plugin, affecting versions 2.33.0 and earlier . The flaw is in the Subscriber functionality and was discovered by dutafi . The CVSS 3.1 score is 8.5 (HIGH) , with a network attack vector, low complexity, and...