Yith Woocommerce Quick View Vulnerabilities

The YITH WooCommerce Quick View plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's yith_quick_view shortcode in all versions up to, and including, 2.7.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attack...

CVSS:

6.4

Affected:

up to 2.7.0

Fixed in:

2.7.1

Disclosed:

Dec 12, 2025

CVE-2025-8617 on NVD →

Several YITHEMES plugins for WordPress are vulnerable to authorization bypass due to a missing capability check on the create_log_file function. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to download the logs of the plugin which can contain sensitive information. Pl...

CVSS:

7.1

Affected:

up to 1.21.0

Fixed in:

1.21.1

Disclosed:

Nov 11, 2022

Several YITHEMES plugins for WordPress are vulnerable to Cross-Site Request Forgery. This is due to missing or incorrect nonce validation on the create_log_file function. This makes it possible for unauthenticated attackers to create an error or debug log file using the plugin, via forged request granted they can trick...

CVSS:

4.3

Affected:

up to 1.21.0

Fixed in:

1.21.1

Disclosed:

Nov 11, 2022

CVE-2022-44630 on NVD →

Various versions of a various YITH WooCommerce plugins that use the YIT Plugin Framework through 3.3.8 are vulnerable to authorization bypass due to a missing capability check in the the 'save_toggle_element_options' function in .plugin-fw/lib/yit-plugin-panel-wc.php. This allows authenticated users with subscriber-lev...

CVSS:

4.3

Affected:

up to 1.3.13

Fixed in:

1.3.15

Disclosed:

Oct 31, 2019

CVE-2019-16251 on NVD →