Skip to content
Noroxi

YITHEMES records

19 published records for vendor yithemes.

Researcher profile

Entered KEV
0 · 0%
Weaponized
0 · 0%
Pre-auth RCE
1
With a fix record
47.4%
Median publish → KEV
No record has entered KEV

Records by year

  1. 19
  2. 21
  3. 22
  4. 23
  5. 24

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

All records

19 records
  • CVE-2021-3120
    50Plan

    An arbitrary file upload vulnerability in the YITH WooCommerce Gift Cards Premium plugin before 3.3.1 for WordPress allows remote attackers

    CriticalCVSS 9.8No exploitEPSS 36%

    yithemes · yith woocommerce gift cardsFeb 22, 2021

  • CVE-2022-45359
    43Plan

    WordPress YITH WooCommerce Gift Cards Premium Plugin <= 3.19.0 is vulnerable to Arbitrary File Upload

    CriticalCVSS 9.8No exploitEPSS 13%

    yithemes · yith woocommerce gift cardsDec 6, 2022

  • CVE-2024-47350
    37Monitor

    WordPress YITH WooCommerce Ajax Search plugin <= 2.8.0 - SQL Injection vulnerability

    CriticalCVSS 9.3No exploitEPSS 0%

    yithemes · yith woocommerce ajax searchOct 6, 2024

  • CVE-2023-49777
    35Monitor

    WordPress YITH WooCommerce Product Add-Ons Plugin <= 4.3.0 is vulnerable to PHP Object Injection

    HighCVSS 8.8No exploitEPSS 0%

    yithemes · yith woocommerce product add-onsDec 31, 2023

  • CVE-2024-30470
    35Monitor

    WordPress YITH WooCommerce Account Funds Premium plugin <= 1.32.0 - Broken Access Control vulnerability

    HighCVSS 8.8No exploitEPSS 0%

    yithemes · woocommerce account fundsJun 9, 2024

  • CVE-2015-9429
    26Monitor

    The yith-maintenance-mode plugin before 1.2.0 for WordPress has CSRF with resultant XSS via the wp-admin/themes.php?page=yith-maintenance-mo

    MediumCVSS 6.5No exploitEPSS 0%

    yithemes · yith maintenance modeSep 25, 2019

  • CVE-2024-4455
    24Monitor

    YITH WooCommerce Ajax Search <= 2.4.0 - Unauthenticated Stored Cross-Site Scripting

    MediumCVSS 6.1Proof of conceptEPSS 1%

    yithemes · yith woocommerce ajax searchMay 24, 2024

  • CVE-2022-0818
    24Monitor

    Coupon Affiliates < 4.16.4.5 - Unauthenticated Stored XSS

    MediumCVSS 6.1No exploitEPSS 0%

    yithemes · woocommerce affiliateMar 28, 2022

  • CVE-2024-8665
    24Monitor

    YITH Custom Login <= 1.7.3 - Reflected Cross-Site Scripting

    MediumCVSS 6.1No exploitEPSS 0%

    yithemes · yith custom loginSep 13, 2024

  • CVE-2024-50448
    24Monitor

    WordPress YITH WooCommerce Product Add-Ons plugin <= 4.14.1 - Reflected Cross Site Scripting (XSS) vulnerability

    MediumCVSS 6.1No exploitEPSS 0%

    yithemes · yith woocommerce product add-onsOct 28, 2024

  • CVE-2021-36841
    21Monitor

    YITH Maintenance Mode (WordPress plugin) <= 1.3.7 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability.

    MediumCVSS 5.4No exploitEPSS 0%

    yithemes · yith maintenance modeSep 27, 2021

  • CVE-2024-0870
    21Monitor

    YITH WooCommerce Gift Cards <= 4.12.0 - Missing Authorization to Unauthenticated WooCommerce Settings Update

    MediumCVSS 5.3No exploitEPSS 0%

    yithemes · yith woocommerce gift cardsMay 14, 2024

  • CVE-2024-7846
    21Monitor

    YITH WooCommerce Ajax Search < 2.7.1 - Contributor+ Stored XSS

    MediumCVSS 5.4No exploitEPSS 0%

    yithemes · yith woocommerce ajax searchSep 23, 2024

  • CVE-2024-35680
    21Monitor

    WordPress YITH WooCommerce Product Add-Ons plugin <= 4.9.2 - Content Injection vulnerability

    MediumCVSS 5.3No exploitEPSS 0%

    yithemes · yith woocommerce product add-onsJun 10, 2024

  • CVE-2021-36845
    19Monitor

    YITH Maintenance Mode (WordPress plugin) <= 1.3.8 - Multiple Authenticated Stored Cross-Site Scripting (XSS) vulnerabilities

    MediumCVSS 4.8No exploitEPSS 0%

    yithemes · yith maintenance modeSep 27, 2021

  • CVE-2024-35732
    19Monitor

    WordPress YITH Custom Login plugin <= 1.7.0 - Cross Site Scripting (XSS) vulnerability

    MediumCVSS 4.8No exploitEPSS 0%

    yithemes · yith custom loginJun 8, 2024

  • CVE-2024-35698
    19Monitor

    WordPress YITH WooCommerce Tab Manager plugin <= 1.35.0 - Cross Site Scripting (XSS) vulnerability

    MediumCVSS 4.8No exploitEPSS 0%

    yithemes · yith woocommerce tab managerJun 8, 2024

  • CVE-2019-16251
    17Monitor

    plugin-fw/lib/yit-plugin-panel-wc.php in the YIT Plugin Framework through 3.3.8 for WordPress allows authenticated options changes.

    MediumCVSS 4.3No exploitEPSS 0%

    yithemes · yith woocommerce wishlistOct 31, 2019

  • CVE-2024-6799
    17Monitor

    YITH Essential Kit for WooCommerce #1 <= 2.34.0 - Missing Authorization to Authenticated (Subscriber+) Limited Plugin Install, Activation, and Deactivation

    MediumCVSS 4.3No exploitEPSS 0%

    yithemes · yith essential kit for woocommerceJul 19, 2024