WordPress YITH WooCommerce Waiting List Plugin <= 2.13.0 is vulnerable to Broken Access Control

Software YITH WooCommerce Waiting List Type Plugin Vulnerable versions = 2.13.0 Fixed in 2.13.1 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-36506 Patch priority Low CVSS severity Low 5.3 Developer YITH PSID d3cc24363c20 Credits thiennv Required privile...

WordPress YITH WooCommerce Gift Cards Premium Plugin <= 3.23.1 is vulnerable to Broken Access Control

Software YITH WooCommerce Gift Cards Premium Type Plugin Vulnerable versions = 3.23.1 Fixed in 3.24.0 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2022-44633 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 9a5270f7dbc9 Credits...

WordPress YITH WooCommerce Product Slider Carousel Plugin <= 1.16.0 is vulnerable to Cross Site Request Forgery (CSRF)

Software YITH WooCommerce Product Slider Carousel Type Plugin Vulnerable versions = 1.16.0 Fixed in 1.16.1 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2022-44630 Patch priority Low CVSS severity Low 4.6 Developer YITH PSID a92ff4b1506a Credits...

WordPress plugin has been exploited in the wild to mount backdoors

Threat Level Vulnerability Report For a detailed threat advisory, download the pdf file here Summary Malicious actors are actively exploiting a critical vulnerability in the YITH WooCommerce Gift Cards Premium WordPress plugin in order to plant backdoors on e-Commerce sites. The security flaw...

WordPress Yith WooCommerce Gift Cards Premium 3.19.0 Shell Upload Vulnerability

Description: Unauthenticated Arbitrary File Upload Affected Plugin: Yith WooCommerce Gift Cards Premium Plugin Slug: yith-woocommerce-gift-cards-premium Affected Versions: = 3.19.0 CVE ID: CVE-2022-45359 CVSS Score: 9.8 Critical CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N...

PSA: YITH WooCommerce Gift Cards Premium Plugin Exploited in the Wild

The Wordfence Threat Intelligence team has been tracking exploits targeting a Critical Severity Arbitrary File Upload vulnerability in YITH WooCommerce Gift Cards Premium, a plugin with over 50,000 installations according to the vendor. The vulnerability, reported by security researcher Dave Jong...

CVE-2022-45359

Unauth. Arbitrary File Upload vulnerability in YITH WooCommerce Gift Cards premium plugin = 3.19.0 on WordPress...

CVE-2022-45359

Unauth. Arbitrary File Upload vulnerability in YITH WooCommerce Gift Cards premium plugin = 3.19.0 on WordPress...

Design/Logic Flaw

Unauth. Arbitrary File Upload vulnerability in YITH WooCommerce Gift Cards premium plugin = 3.19.0 on WordPress...

CVE-2022-45359

CVE-2022-45359 affects the WordPress YITH WooCommerce Gift Cards Premium plugin up to version 3.19.0. The vulnerability is an unauthenticated Arbitrary File Upload via the import_actions_from_settings_panel function that runs on admin_init, allowing attackers to upload files (e.g., web shells) wi...

CVE-2022-45359 WordPress YITH WooCommerce Gift Cards Premium Plugin <= 3.19.0 is vulnerable to Arbitrary File Upload

Unauth. Arbitrary File Upload vulnerability in YITH WooCommerce Gift Cards premium plugin = 3.19.0 on WordPress...

CVE-2022-45359

Unauth. Arbitrary File Upload vulnerability in YITH WooCommerce Gift Cards premium plugin = 3.19.0 on WordPress. Recent assessments: Assessed Attacker Value: 0 Assessed Attacker Value: 0Assessed Attacker Value: 0...

PT-2022-27476 · Yith · Yith Woocommerce Gift Cards

Name of the Vulnerable Software and Affected Versions: YITH WooCommerce Gift Cards premium plugin versions 3.19.0 and earlier Description: The issue is related to an Unauth. Arbitrary File Upload vulnerability in the YITH WooCommerce Gift Cards premium plugin on WordPress, which allows unauthoriz...

WordPress plugin YITH WooCommerce Gift Cards premium 代码问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers. bbPress is a forum plugin used in it. WordPress plugin is an application plugin. A co...

Multiple YITH WooCommerce plugins - Cross-Site Scripting via shortcode ajax

Multiple plugins from YITH does not protect its ajax actions against CSRF attacks, allowing an attacker to trick a logged in user to perform actions on their behalf by submitting a crafted request...

WordPress YITH WooCommerce Gift Cards Premium plugin <= 3.19.0 - Unauth. Arbitrary File Upload vulnerability

Unauth. Arbitrary File Upload vulnerability discovered by Dave Jong Patchstack in WordPress YITH WooCommerce Gift Cards Premium plugin versions = 3.19.0. Solution Update the WordPress YITH WooCommerce Gift Cards Premium plugin to the latest available version at least 3.20.0...

YITH WooCommerce Multi Vendor < 3.8.1 - Reflected Cross-Site Scripting

The plugin does not escape some parameters before outputting them back in admin pages, leading to Reflected Cross-Site Scripting issues PoC https://example.com/wp-admin/admin.php?page=yithvendorcommissions=error= fixed in 3.8.0 Below fixed in 3.8.1...

CVE-2021-36841

Authenticated Stored Cross-Site Scripting XSS vulnerability in YITH Maintenance Mode WordPress plugin versions = 1.3.7, vulnerable parameter &yithmaintenancenewslettersubmitlabel. Possible even when unfiltered HTML is disallowed by WordPress configuration...

CVE-2021-36845

Multiple Authenticated Stored Cross-Site Scripting XSS vulnerabilities in YITH Maintenance Mode WordPress plugin versions = 1.3.8, there are 46 vulnerable parameters that were missed by the vendor while patching the 1.3.7 version to 1.3.8. Vulnerable parameters: 1 - "Newsletter" tab,...

CVE-2021-36841

Authenticated Stored Cross-Site Scripting XSS vulnerability in YITH Maintenance Mode WordPress plugin versions = 1.3.7, vulnerable parameter &yithmaintenancenewslettersubmitlabel. Possible even when unfiltered HTML is disallowed by WordPress configuration...