CVE-2024-35698

CVE-2024-35698 is a Cross-Site Scripting vulnerability in YITH WooCommerce Tab Manager (yith-woocommerce-tab-manager) that affects versions n/a through

WordPress YITH WooCommerce Product Add-Ons Plugin <= 4.9.2 is vulnerable to Content Injection

Software YITH WooCommerce Product Add-Ons Type Plugin Vulnerable versions = 4.9.2 Fixed in 4.9.3 OWASP Top 10 A3: Injection Classification Content Injection CVE CVE-2024-35680 Patch priority Low CVSS severity Low 5.3 Developer YITH PSID b074b61667f8 Credits savphill Required privilege...

WordPress YITH WooCommerce Tab Manager Plugin <= 1.35.0 is vulnerable to Cross Site Scripting (XSS)

Software YITH WooCommerce Tab Manager Type Plugin Vulnerable versions = 1.35.0 Fixed in 1.35.1 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-35698 Patch priority Low CVSS severity Low 5.9 Developer YITH PSID d6384d72bb85 Credits savphill Required privilege Editor...

CVE-2024-34385

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in YITHEMES YITH WooCommerce Wishlist yith-woocommerce-wishlist.This issue affects YITH WooCommerce Wishlist: from n/a through = 3.32.0...

CVE-2024-34385 WordPress YITH WooCommerce Wishlist plugin <= 3.32.0 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in YITH YITH WooCommerce Wishlist allows Stored XSS.This issue affects YITH WooCommerce Wishlist: from n/a through 3.32.0...

CVE-2024-34385 WordPress YITH WooCommerce Wishlist plugin <= 3.32.0 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in YITHEMES YITH WooCommerce Wishlist yith-woocommerce-wishlist.This issue affects YITH WooCommerce Wishlist: from n/a through = 3.32.0...

WordPress YITH WooCommerce Wishlist plugin <= 3.32.0 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Savphill Patchstack Alliance in WordPress Plugin YITH WooCommerce Wishlist versions = 3.32.0...

WordPress YITH WooCommerce Wishlist Plugin <= 3.32.0 is vulnerable to Cross Site Scripting (XSS)

Software YITH WooCommerce Wishlist Type Plugin Vulnerable versions = 3.32.0 Fixed in 3.33.0 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-34385 Patch priority Low CVSS severity Low 5.9 Developer YITH PSID 293b2a23f462 Credits savphill Required privilege...

CVE-2024-4455 YITH WooCommerce Ajax Search <= 2.4.0 - Unauthenticated Stored Cross-Site Scripting

The YITH WooCommerce Ajax Search plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘item’ parameter in versions up to, and including, 2.4.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary...

WordPress YITH WooCommerce Ajax Search plugin <= 2.4.0 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by Krzysztof Zając in WordPress Plugin YITH WooCommerce Ajax Search versions = 2.4.0...

WordPress YITH WooCommerce Ajax Search Plugin <= 2.4.0 is vulnerable to Cross Site Scripting (XSS)

Software YITH WooCommerce Ajax Search Type Plugin Vulnerable versions = 2.4.0 Fixed in 2.4.1 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-4455 Patch priority High CVSS severity High 7.1 Developer YITH PSID cdafc8b37008 Credits Krzysztof Zając...

VulnCheck KEV: CVE-2024-4455

The YITH WooCommerce Ajax Search plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the item parameter in versions up to, and including, 2.4.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary...

PT-2024-31173

Name of the Vulnerable Software and Affected Versions YITH WooCommerce Ajax Search plugin for WordPress versions up to and including 2.4.0 Description The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping, allowing unauthenticated attackers...

YITH WooCommerce Ajax Search < 2.4.1 - Unauthenticated Stored Cross-Site Scripting

Description The YITH WooCommerce Ajax Search plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘item’ parameter in versions up to, and including, 2.4.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to injec...

CVE-2024-0870

The YITH WooCommerce Gift Cards plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'savemailstatus' and 'saveemailsettings' functions in all versions up to, and including, 4.12.0. This makes it possible for unauthenticated attackers to...

CVE-2024-0870 YITH WooCommerce Gift Cards <= 4.12.0 - Missing Authorization to Unauthenticated WooCommerce Settings Update

The YITH WooCommerce Gift Cards plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'savemailstatus' and 'saveemailsettings' functions in all versions up to, and including, 4.12.0. This makes it possible for unauthenticated attackers to...

CVE-2024-0870

CVE-2024-0870 (YITH WooCommerce Gift Cards for WordPress) is an unauthenticated data-modification vulnerability caused by a missing capability check on save_mail_status and save_email_settings. Affected versions are all up to and including 4.12.0. The issue enables unauthenticated attackers to mo...

CVE-2024-0870 YITH WooCommerce Gift Cards <= 4.12.0 - Missing Authorization to Unauthenticated WooCommerce Settings Update

The YITH WooCommerce Gift Cards plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'savemailstatus' and 'saveemailsettings' functions in all versions up to, and including, 4.12.0. This makes it possible for unauthenticated attackers to...

WordPress YITH WooCommerce Gift Cards Plugin <= 4.12.0 is vulnerable to Broken Access Control

Software YITH WooCommerce Gift Cards Type Plugin Vulnerable versions = 4.12.0 Fixed in 4.13.0 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-0870 Patch priority Low CVSS severity Low 5.3 Developer YITH PSID 8dd8ed435d7e Credits Francesco Carlucci Required...

YITH WooCommerce Compare < 2.38.0 - Cross-Site Request Forgery

Description The YITH WooCommerce Compare is vulnerable to Cross-Site Request Forgery. This is due to missing or incorrect nonce validation on several functions. This makes it possible for unauthenticated attackers to add/remove things from a product compare via a forged request granted they can...