Yith Paypal Express Checkout For Woocommerce Vulnerabilities

The YITH PayPal Express Checkout for WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.49.0. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to perform an unauthorized action grant...

CVSS:

4.3

Affected:

up to 1.49.0

Fixed in:

1.49.1

Disclosed:

Jun 16, 2025

CVE-2025-48111 on NVD →

Several YITHEMES plugins for WordPress are vulnerable to authorization bypass due to a missing capability check on the create_log_file function. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to download the logs of the plugin which can contain sensitive information. Pl...

CVSS:

7.1

Affected:

up to 1.20.0

Fixed in:

1.20.1

Disclosed:

Nov 11, 2022

Several YITHEMES plugins for WordPress are vulnerable to Cross-Site Request Forgery. This is due to missing or incorrect nonce validation on the create_log_file function. This makes it possible for unauthenticated attackers to create an error or debug log file using the plugin, via forged request granted they can trick...

CVSS:

4.3

Affected:

up to 1.20.0

Fixed in:

1.20.1

Disclosed:

Nov 11, 2022

CVE-2022-44630 on NVD →

Various versions of a various YITH WooCommerce plugins that use the YIT Plugin Framework through 3.3.8 are vulnerable to authorization bypass due to a missing capability check in the the 'save_toggle_element_options' function in .plugin-fw/lib/yit-plugin-panel-wc.php. This allows authenticated users with subscriber-lev...

CVSS:

4.3

Affected:

up to 1.2.5

Fixed in:

1.2.6

Disclosed:

Oct 31, 2019

CVE-2019-16251 on NVD →