# YITH vulnerabilities Source: https://junglewise.ai/threats/vendors/yith Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 13 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/vendors/yith.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 20 vulnerabilities in YITH: 3 in the last 7 days and 18 in the last 90 days, 1 of them critical and 0 exploited in the wild. The most recent, CVE-2026-125761, was published on 11 November 2026. 8 vulnerabilities in the last four weeks, up 60% on the four before (5). 2 technologies have a page of their own. ## Counts - Last 7 days: 3 - Last 30 days: 10 - Last 90 days: 18 - All time: 20 (1 critical, 0 exploited in the wild) ## About YITH A developer of premium plugins and themes for WordPress and WooCommerce. ## Latest YITH vulnerabilities - [CVE-2026-125761: YITH WooCommerce Ajax Search stored cross-site scripting](https://junglewise.ai/threats/cve-2026-125761-improper-neutralization-of-input-during-web-page-generation) (medium, CVSS 6.5, published 11 Nov 2026) - [CVE-2026-88813: YITH WooCommerce Gift Cards price inflation in discounted purchases](https://junglewise.ai/threats/cve-2026-88813-the-yith-woocommerce-gift-cards-wordpress-plugin-through-4-39-0) (info, published 11 Nov 2026) - [CVE-2026-121779: YITH WooCommerce Subscription sensitive data exposure](https://junglewise.ai/threats/cve-2026-121779-exposure-of-sensitive-system-information-to-an-unauthorized) (medium, CVSS 5.3, published 7 Nov 2026) - [CVE-2026-88814: YITH WooCommerce Gift Cards race condition in balance redemption](https://junglewise.ai/threats/cve-2026-88814-the-yith-woocommerce-gift-cards-wordpress-plugin-before-4-38-1) (info, published 5 Nov 2026) - [CVE-2026-107868: YITH WooCommerce Product Add-Ons unauthenticated bypass](https://junglewise.ai/threats/cve-2026-107868-unauthenticated-bypass-vulnerability-in-yith-woocommerce-product) (medium, CVSS 5.3, published 30 Oct 2026) - [CVE-2026-27401: YITH PayPal Express Checkout for WooCommerce broken access control](https://junglewise.ai/threats/cve-2026-27401-missing-authorization-vulnerability-in-yith-yith-paypal-express) (medium, CVSS 5.3, published 29 Oct 2026) - [CVE-2026-112199: YITH WooCommerce Wishlist stored cross-site scripting](https://junglewise.ai/threats/cve-2026-112199-improper-neutralization-of-input-during-web-page-generation) (medium, CVSS 6.5, published 19 Oct 2026) - [CVE-2026-111845: YITH WooCommerce Product Bundles broken access control](https://junglewise.ai/threats/cve-2026-111845-missing-authorization-vulnerability-in-yith-yith-woocommerce) (medium, CVSS 5.3, published 19 Oct 2026) - [CVE-2026-111409: YITH PayPal Express Checkout broken access control](https://junglewise.ai/threats/cve-2026-111409-missing-authorization-vulnerability-in-yith-yith-paypal-express) (medium, CVSS 5.3, published 16 Oct 2026) - [CVE-2026-106604: YITH WooCommerce Compare stored XSS in product listings](https://junglewise.ai/threats/cve-2026-106604-improper-neutralization-of-input-during-web-page-generation) (medium, CVSS 6.5, published 15 Oct 2026) - [CVE-2026-66480: YITH WooCommerce Product Add-Ons sensitive data exposure](https://junglewise.ai/threats/cve-2026-66480-exposure-of-sensitive-system-information-to-an-unauthorized) (medium, CVSS 5.3, published 10 Oct 2026) - [CVE-2026-106606: YITH WooCommerce Affiliates PHP object injection](https://junglewise.ai/threats/cve-2026-106606-deserialization-of-untrusted-data-vulnerability-in-yith-yith) (high, CVSS 7.2, published 10 Oct 2026) - [CVE-2026-97292: YITH WooCommerce Tab Manager cross-site scripting in author roles](https://junglewise.ai/threats/cve-2026-97292-author-cross-site-scripting-xss-in-yith-woocommerce-tab-manager-2) (medium, CVSS 6.5, published 30 Sep 2026) - [CVE-2026-96352: YITH WooCommerce Ajax Search cross-site scripting in search parameters](https://junglewise.ai/threats/cve-2026-96352-unauthenticated-cross-site-scripting-xss-in-yith-woocommerce-ajax) (high, CVSS 7.1, published 30 Sep 2026) - [CVE-2026-95602: YITH WooCommerce Request A Quote insecure direct object reference](https://junglewise.ai/threats/cve-2026-95602-authorization-bypass-through-user-controlled-key-vulnerability-in) (medium, CVSS 6.5, published 23 Sep 2026) - [CVE-2026-82305: YITH WooCommerce Wishlist unauthenticated arbitrary wishlist rename](https://junglewise.ai/threats/cve-2026-82305-yith-woocommerce-wishlist-unauthenticated-arbitrary-wishlist) (medium, CVSS 5.3, published 11 Sep 2026) - [CVE-2026-14359: YITH WooCommerce Waitlist Premium privilege escalation](https://junglewise.ai/threats/cve-2026-14359-yith-woocommerce-waitlist-premium-privilege-escalation) (high, CVSS 8.8, published 9 Sep 2026) - [CVE-2026-84238: YITH Request a Quote for WooCommerce Premium broken access control](https://junglewise.ai/threats/cve-2026-84238-yith-request-a-quote-for-woocommerce-premium-broken-access) (critical, CVSS 9.8, published 3 Sep 2026) - [CVE-2022-44630: YITH WooCommerce Product Slider Carousel CSRF](https://junglewise.ai/threats/cve-2022-44630-yith-woocommerce-product-slider-carousel-csrf) (medium, CVSS 4.6, published 11 Jun 2026) - [CVE-2026-42383: YITH WooCommerce Product Add-Ons SQL injection](https://junglewise.ai/threats/cve-2026-42383-yith-woocommerce-product-add-ons-sql-injection) (high, CVSS 7.6, published 20 May 2026) ## Most severe YITH vulnerabilities - [CVE-2026-84238: YITH Request a Quote for WooCommerce Premium broken access control](https://junglewise.ai/threats/cve-2026-84238-yith-request-a-quote-for-woocommerce-premium-broken-access) (critical, CVSS 9.8, published 3 Sep 2026) - [CVE-2026-14359: YITH WooCommerce Waitlist Premium privilege escalation](https://junglewise.ai/threats/cve-2026-14359-yith-woocommerce-waitlist-premium-privilege-escalation) (high, CVSS 8.8, published 9 Sep 2026) - [CVE-2026-42383: YITH WooCommerce Product Add-Ons SQL injection](https://junglewise.ai/threats/cve-2026-42383-yith-woocommerce-product-add-ons-sql-injection) (high, CVSS 7.6, published 20 May 2026) - [CVE-2026-106606: YITH WooCommerce Affiliates PHP object injection](https://junglewise.ai/threats/cve-2026-106606-deserialization-of-untrusted-data-vulnerability-in-yith-yith) (high, CVSS 7.2, published 10 Oct 2026) - [CVE-2026-96352: YITH WooCommerce Ajax Search cross-site scripting in search parameters](https://junglewise.ai/threats/cve-2026-96352-unauthenticated-cross-site-scripting-xss-in-yith-woocommerce-ajax) (high, CVSS 7.1, published 30 Sep 2026) - [CVE-2026-95602: YITH WooCommerce Request A Quote insecure direct object reference](https://junglewise.ai/threats/cve-2026-95602-authorization-bypass-through-user-controlled-key-vulnerability-in) (medium, CVSS 6.5, published 23 Sep 2026) - [CVE-2026-106604: YITH WooCommerce Compare stored XSS in product listings](https://junglewise.ai/threats/cve-2026-106604-improper-neutralization-of-input-during-web-page-generation) (medium, CVSS 6.5, published 15 Oct 2026) - [CVE-2026-125761: YITH WooCommerce Ajax Search stored cross-site scripting](https://junglewise.ai/threats/cve-2026-125761-improper-neutralization-of-input-during-web-page-generation) (medium, CVSS 6.5, published 11 Nov 2026) - [CVE-2026-112199: YITH WooCommerce Wishlist stored cross-site scripting](https://junglewise.ai/threats/cve-2026-112199-improper-neutralization-of-input-during-web-page-generation) (medium, CVSS 6.5, published 19 Oct 2026) - [CVE-2026-97292: YITH WooCommerce Tab Manager cross-site scripting in author roles](https://junglewise.ai/threats/cve-2026-97292-author-cross-site-scripting-xss-in-yith-woocommerce-tab-manager-2) (medium, CVSS 6.5, published 30 Sep 2026) ## Vulnerabilities per week 8 vulnerabilities in the last four weeks, up 60% on the four before (5). | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 1 | 1 | 0 | | 7 Sep 2026 | 2 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 1 | 0 | 0 | | 28 Sep 2026 | 2 | 0 | 0 | | 5 Oct 2026 | 2 | 0 | 0 | | 12 Oct 2026 | 2 | 0 | 0 | | 19 Oct 2026 | 2 | 0 | 0 | | 26 Oct 2026 | 2 | 0 | 0 | | 2 Nov 2026 | 2 | 0 | 0 | | 9 Nov 2026 | 2 | 0 | 0 | ## YITH technologies - [YITH WooCommerce Product Add-Ons](https://junglewise.ai/threats/technologies/woocommerce-product-add-ons): 3 vulnerabilities - [YITH WooCommerce Wishlist](https://junglewise.ai/threats/technologies/woocommerce-wishlist): 3 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "YITH vulnerabilities", https://junglewise.ai/threats/vendors/yith, 13 November 2026.