# CVE-2022-44630: YITH WooCommerce Product Slider Carousel CSRF

Source: https://junglewise.ai/threats/cve-2022-44630-yith-woocommerce-product-slider-carousel-csrf  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-11. Updated: 2026-06-11  
License: CC BY 4.0 with a link back

CVE-2022-44630 · Severity: medium · CVSS 4.6 · Published 2026-06-11

The YITH WooCommerce Product Slider Carousel plugin for WordPress, which allows store owners to display products in an interactive slider, is vulnerable to a security flaw. An attacker could trick a logged-in administrator or authorized user into performing unintended actions on the website, such as changing plugin settings. This could lead to unauthorized modifications of the site's appearance or configuration if a user clicks on a malicious link while logged in.

Vendors: [YITH](https://junglewise.ai/threats/vendors/yith).

## Quick answers

**Is CVE-2022-44630 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2022-44630 being exploited in the wild.

**How severe is CVE-2022-44630?** Medium severity, with a CVSS score of 4.6, published 11 June 2026.

**Which products and versions are affected?** YITH WooCommerce Product Slider Carousel <= 1.16.0.

**Is there a fix for CVE-2022-44630?** A patch was published on 2023-03-03: Version 1.16.1 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2022-44630 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2022-44630?** Check whether you run YITH WooCommerce Product Slider Carousel at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A Cross-Site Request Forgery (CSRF) vulnerability exists in the YITH WooCommerce Product Slider Carousel plugin for WordPress (versions <= 1.16.0). The issue stems from a lack of proper nonce validation on sensitive administrative actions. An attacker can exploit this by crafting a malicious request and tricking a privileged user into executing it via social engineering (e.g., a malicious link). Successful exploitation allows the attacker to perform unauthorized actions with the permissions of the victim user, such as modifying plugin settings. The vulnerability is addressed in version 1.16.1.

## Affected products

- YITH YITH WooCommerce Product Slider Carousel <= 1.16.0

## Timeline

- 2022-11-02: disclosed: Reported by István Márton
- 2023-03-03: advisory: Patchstack published advisory
- 2023-03-03: patched: Version 1.16.1 released

## References

- [https://patchstack.com/database/wordpress/plugin/yith-woocommerce-product-slider-carousel/vulnerability/wordpress-yith-woocommerce-product-slider-carousel-plugin-1-16-0-cross-site-request-forgery-csrf?_s_id=cve](https://patchstack.com/database/wordpress/plugin/yith-woocommerce-product-slider-carousel/vulnerability/wordpress-yith-woocommerce-product-slider-carousel-plugin-1-16-0-cross-site-request-forgery-csrf?_s_id=cve)