YITH WooCommerce Ajax Search <= 2.4.0 - Cross-Site Scripting

The YITH WooCommerce Ajax Search plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'queryString' parameter in the REST API endpoint /ywcas/v1/register in versions up to, and including, 2.4.0 due to insufficient input sanitization and output escaping. id: CVE-2024-4455 info...

CVE-2026-111409

Missing Authorization vulnerability in YITH YITH PayPal Express Checkout for WooCommerce yith-paypal-express-checkout-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects YITH PayPal Express Checkout for WooCommerce: from n/a through 1.61.0...

EUVD-2026-102865

Missing Authorization vulnerability in YITH YITH PayPal Express Checkout for WooCommerce yith-paypal-express-checkout-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects YITH PayPal Express Checkout for WooCommerce: from n/a through 1.61.0...

CVE-2026-111409

The YITH PayPal Express Checkout for WooCommerce plugin (versions

CVE-2026-111409 WordPress YITH PayPal Express Checkout for WooCommerce plugin <= 1.61.0 - Broken Access Control vulnerability

Missing Authorization vulnerability in YITH YITH PayPal Express Checkout for WooCommerce yith-paypal-express-checkout-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects YITH PayPal Express Checkout for WooCommerce: from n/a through 1.61.0...

WordPress YITH PayPal Express Checkout for WooCommerce plugin <= 1.61.0 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Oly Hossen in WordPress Plugin YITH PayPal Express Checkout for WooCommerce versions = 1.61.0...

CVE-2026-106604

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in YITH YITH WooCommerce Compare yith-woocommerce-compare allows Stored XSS.This issue affects YITH WooCommerce Compare: from n/a through 3.15.0...

EUVD-2026-102237

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in YITH YITH WooCommerce Compare yith-woocommerce-compare allows Stored XSS.This issue affects YITH WooCommerce Compare: from n/a through 3.15.0...

CVE-2026-106604

The YITH WooCommerce Compare WordPress plugin (versions 3.15.0 and below ) is vulnerable to a Stored Cross-Site Scripting (XSS) flaw. The root cause is the improper neutralization of input during web page generation. This vulnerability allows an attacker to inject malicious scripts that are store...

CVE-2026-106604 WordPress YITH WooCommerce Compare plugin <= 3.15.0 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in YITH YITH WooCommerce Compare yith-woocommerce-compare allows Stored XSS.This issue affects YITH WooCommerce Compare: from n/a through 3.15.0...

WordPress YITH WooCommerce Compare plugin <= 3.15.0 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Intrudify in WordPress Plugin YITH WooCommerce Compare versions = 3.15.0...

CVE-2026-92426

The YITH WooCommerce Popup WordPress plugin before 1.60.0 does not check the capability of the requesting user before deleting post meta, allowing users with the Contributor role and above to delete arbitrary post meta from any post, including content owned by higher-privileged users...

EUVD-2026-100864

The YITH WooCommerce Popup WordPress plugin before 1.60.0 does not check the capability of the requesting user before deleting post meta, allowing users with the Contributor role and above to delete arbitrary post meta from any post, including content owned by higher-privileged users...

CVE-2026-92426 YITH WooCommerce Popup < 1.60.0 - Contributor+ Arbitrary Post Meta Deletion

The YITH WooCommerce Popup WordPress plugin before 1.60.0 does not check the capability of the requesting user before deleting post meta, allowing users with the Contributor role and above to delete arbitrary post meta from any post, including content owned by higher-privileged users...

CVE-2026-92426

The YITH WooCommerce Popup WordPress plugin versions prior to 1.60.0 is vulnerable to an Incorrect Authorization flaw (CWE-863 ). The plugin fails to verify the requesting user's capabilities before performing post meta deletion operations. This allows any authenticated user with a Contributor ro...

CVE-2026-92426 YITH WooCommerce Popup < 1.60.0 - Contributor+ Arbitrary Post Meta Deletion

The YITH WooCommerce Popup WordPress plugin before 1.60.0 does not check the capability of the requesting user before deleting post meta, allowing users with the Contributor role and above to delete arbitrary post meta from any post, including content owned by higher-privileged users...

WordPress YITH WooCommerce Popup plugin < 1.60.0 - Contributor+ Arbitrary Post Meta Deletion vulnerability

Contributor+ Arbitrary Post Meta Deletion vulnerability discovered by JunHee CHO in WordPress Plugin YITH WooCommerce Popup versions 1.60.0...

PT-2026-113693

The YITH WooCommerce Popup WordPress plugin before 1.60.0 does not check the capability of the requesting user before deleting post meta, allowing users with the Contributor role and above to delete arbitrary post meta from any post, including content owned by higher-privileged users...

CVE-2026-66480

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in YITH YITH WooCommerce Product Add-Ons allows Retrieve Embedded Sensitive Data. This issue affects YITH WooCommerce Product Add-Ons: from n/a through 4.34.0...

CVE-2026-66480 WordPress YITH WooCommerce Product Add-Ons plugin <= 4.34.0 - Sensitive Data Exposure vulnerability

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in YITH YITH WooCommerce Product Add-Ons allows Retrieve Embedded Sensitive Data. This issue affects YITH WooCommerce Product Add-Ons: from n/a through 4.34.0...