Yith Woocommerce Zoom Magnifier Vulnerabilities

The YITH WooCommerce Zoom Magnifier plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 2.52.0. This makes it possible for unauthenticated attackers to extract sensitive user or configuration data.

CVSS:

5.3

Affected:

up to 2.52.0

Fixed in:

2.52.1

Disclosed:

Aug 5, 2026

CVE-2026-28169 on NVD →

Several YITHEMES plugins for WordPress are vulnerable to authorization bypass due to a missing capability check on the create_log_file function. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to download the logs of the plugin which can contain sensitive information. Pl...

CVSS:

7.1

Affected:

up to 2.14.0

Fixed in:

2.15.0

Disclosed:

Nov 11, 2022

Several YITHEMES plugins for WordPress are vulnerable to Cross-Site Request Forgery. This is due to missing or incorrect nonce validation on the create_log_file function. This makes it possible for unauthenticated attackers to create an error or debug log file using the plugin, via forged request granted they can trick...

CVSS:

4.3

Affected:

up to 2.14.0

Fixed in:

2.15.0

Disclosed:

Nov 11, 2022

CVE-2022-44630 on NVD →

Various versions of a various YITH WooCommerce plugins that use the YIT Plugin Framework through 3.3.8 are vulnerable to authorization bypass due to a missing capability check in the the 'save_toggle_element_options' function in .plugin-fw/lib/yit-plugin-panel-wc.php. This allows authenticated users with subscriber-lev...

CVSS:

4.3

Affected:

up to 1.3.11

Fixed in:

1.3.12

Disclosed:

Oct 31, 2019

CVE-2019-16251 on NVD →