# cve.now: Yithemes

The newest entries naming Yithemes as an affected vendor (up to 200), of 28 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-107868](https://cve.now/CVE-2026-107868.md): WordPress YITH WooCommerce Product Add-Ons plugin \<= 4.34.0 - Bypass Vulnerability vulnerability (CVSS 5.3)
- [CVE-2026-97292](https://cve.now/CVE-2026-97292.md): WordPress YITH WooCommerce Tab Manager plugin \<= 2.15.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2026-96352](https://cve.now/CVE-2026-96352.md): WordPress YITH WooCommerce Ajax Search plugin \<= 2.28.0 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2026-28169](https://cve.now/CVE-2026-28169.md): WordPress YITH WooCommerce Zoom Magnifier plugin \<= 2.52.0 - Sensitive Data Exposure vulnerability (CVSS 5.3)
- [CVE-2026-22333](https://cve.now/CVE-2026-22333.md): WordPress YITH WooCommerce Compare plugin \<= 3.6.0 - Deserialization of untrusted data vulnerability (CVSS 7.2)
- [CVE-2026-24366](https://cve.now/CVE-2026-24366.md): WordPress YITH WooCommerce Request A Quote plugin \<= 2.46.0 - Broken Access Control vulnerability (CVSS 5.3)
- [CVE-2025-68581](https://cve.now/CVE-2025-68581.md): WordPress YITH Slider for page builders plugin \<= 1.0.11 - Broken Access Control vulnerability (CVSS 5.4)
- [CVE-2025-8617](https://cve.now/CVE-2025-8617.md): YITH WooCommerce Quick View \<= 2.7.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via yith\_quick\_view Shortcode (CVSS 6.4)
- [CVE-2025-12427](https://cve.now/CVE-2025-12427.md): YITH WooCommerce Wishlist \<= 4.10.0 - Unauthenticated Insecure Direct Object Reference to Unauthenticated Wishlist Rename (CVSS 5.3)
- [CVE-2025-12777](https://cve.now/CVE-2025-12777.md): YITH WooCommerce Wishlist \<= 4.10.0 - Unauthenticated Wishlist Token Disclosure to Wishlist Item Deletion (CVSS 5.3)
- [CVE-2025-54675](https://cve.now/CVE-2025-54675.md): WordPress YITH WooCommerce Popup Plugin plugin \<= 1.48.0 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 4.3)
- [CVE-2025-48111](https://cve.now/CVE-2025-48111.md): WordPress YITH PayPal Express Checkout for WooCommerce plugin \<= 1.49.0 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3)
- [CVE-2025-5238](https://cve.now/CVE-2025-5238.md): YITH WooCommerce Wishlist \<= 4.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter (CVSS 6.4)
- [CVE-2023-46635](https://cve.now/CVE-2023-46635.md): WordPress YITH WooCommerce Product Add-Ons plugin \<= 4.2.0 - Broken Access Control vulnerability (CVSS 5.3)
- [CVE-2024-50448](https://cve.now/CVE-2024-50448.md): WordPress YITH WooCommerce Product Add-Ons plugin \<= 4.14.1 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2024-47350](https://cve.now/CVE-2024-47350.md): WordPress YITH WooCommerce Ajax Search plugin \<= 2.8.0 - SQL Injection vulnerability (CVSS 9.3)
- [CVE-2024-47367](https://cve.now/CVE-2024-47367.md): WordPress YITH WooCommerce Product Add-Ons plugin \<= 4.13.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2024-8665](https://cve.now/CVE-2024-8665.md): YITH Custom Login \<= 1.7.3 - Reflected Cross-Site Scripting (CVSS 6.1)
- [CVE-2024-37943](https://cve.now/CVE-2024-37943.md): WordPress YITH WooCommerce Ajax Product Filter plugin \<= 5.1.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 5.8)
- [CVE-2024-6799](https://cve.now/CVE-2024-6799.md): YITH Essential Kit for WooCommerce #1 \<= 2.34.0 - Missing Authorization to Authenticated (Subscriber+) Limited Plugin Install, Activation, and Deactivation (CVSS 4.3)
- [CVE-2024-35680](https://cve.now/CVE-2024-35680.md): WordPress YITH WooCommerce Product Add-Ons plugin \<= 4.9.2 - Content Injection vulnerability (CVSS 5.3)
- [CVE-2024-35698](https://cve.now/CVE-2024-35698.md): WordPress YITH WooCommerce Tab Manager plugin \<= 1.35.0 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9)
- [CVE-2024-35732](https://cve.now/CVE-2024-35732.md): WordPress YITH Custom Login plugin \<= 1.7.0 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9)
- [CVE-2024-34385](https://cve.now/CVE-2024-34385.md): WordPress YITH WooCommerce Wishlist plugin \<= 3.32.0 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9)
- [CVE-2024-4455](https://cve.now/CVE-2024-4455.md): YITH WooCommerce Ajax Search \<= 2.4.0 - Unauthenticated Stored Cross-Site Scripting (CVSS 7.2)
- [CVE-2024-0870](https://cve.now/CVE-2024-0870.md): YITH WooCommerce Gift Cards \<= 4.12.0 - Missing Authorization to Unauthenticated WooCommerce Settings Update (CVSS 5.3)
- [CVE-2024-32699](https://cve.now/CVE-2024-32699.md): WordPress YITH WooCommerce Compare plugin \<= 2.37.0 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3)
- [CVE-2024-27994](https://cve.now/CVE-2024-27994.md): WordPress YITH WooCommerce Product Add-Ons plugin \<= 4.5.0 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/yithemes
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.