Yith Woocommerce Ajax Navigation Vulnerabilities

The YITH WooCommerce Ajax Product Filter plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 5.1.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if...

CVSS:

6.1

Affected:

up to 5.1.0

Fixed in:

5.2.0

Disclosed:

Jul 10, 2024

CVE-2024-37943 on NVD →

Several YITHEMES plugins for WordPress are vulnerable to authorization bypass due to a missing capability check on the create_log_file function. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to download the logs of the plugin which can contain sensitive information. Pl...

CVSS:

7.1

Affected:

up to 4.15.0

Fixed in:

4.16.0

Disclosed:

Nov 11, 2022

Several YITHEMES plugins for WordPress are vulnerable to Cross-Site Request Forgery. This is due to missing or incorrect nonce validation on the create_log_file function. This makes it possible for unauthenticated attackers to create an error or debug log file using the plugin, via forged request granted they can trick...

CVSS:

4.3

Affected:

up to 4.15.0

Fixed in:

4.16.0

Disclosed:

Nov 11, 2022

CVE-2022-44630 on NVD →

The YITH WooCommerce Ajax Product Filter plugin for WordPress is vulnerable to Cross-Site Scripting in versions up to, and including, 3.11.0 due to insufficient input sanitization and output escaping. This makes it possible for attackers to inject arbitrary web scripts that execute in a victim's browser.

CVSS:

6.1

Affected:

up to 3.11.1

Fixed in:

3.11.1

Disclosed:

Jun 22, 2020