plugin
10 known security issues reported for the Yith Woocommerce Compare WordPress plugin. Most recent disclosed Aug 7, 2025.
Running Yith Woocommerce Compare on your site? Check whether your installed version is affected.
Scan your site freeThe YITH WooCommerce Compare plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.6.0 via deserialization of untrusted input. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject a PHP Object. No known POP chain is present...
The YITH WooCommerce Compare plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.37.0. This is due to missing or incorrect nonce validation on several functions. This makes it possible for unauthenticated attackers to add/remove things from a product compare via a fo...
Several YITHEMES plugins for WordPress are vulnerable to authorization bypass due to a missing capability check on the create_log_file function. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to download the logs of the plugin which can contain sensitive information. Pl...
Several YITHEMES plugins for WordPress are vulnerable to Cross-Site Request Forgery. This is due to missing or incorrect nonce validation on the create_log_file function. This makes it possible for unauthenticated attackers to create an error or debug log file using the plugin, via forged request granted they can trick...
Various versions of a various YITH WooCommerce plugins that use the YIT Plugin Framework through 3.3.8 are vulnerable to authorization bypass due to a missing capability check in the the 'save_toggle_element_options' function in .plugin-fw/lib/yit-plugin-panel-wc.php. This allows authenticated users with subscriber-lev...
The YITH WooCommerce Compare plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 2.0.9 via deserialization of untrusted input from the 'yith_woocompare_list' cookie. This allows unauthenticated attackers to inject a PHP Object. It has been confirmed that this vulnerability allow...
Run a free security scan to detect vulnerable plugins and themes, exposed files, and malware — no plugin install, no signup.
Scan your site free