SecAlerts
y

yith

Security Risk Profile

39
/100
low

Security Risk Score

Comprehensive risk assessment based on 32 vulnerabilities, EPSS scores, exploitation status, and remediation availability.

📅 Data spans from March 21, 2024 to present

32
Total CVEs
8
Critical+High
0
Exploited
6
Unpatched

Threat Assessment

Avg CVSS
6.2
Base severity
Avg EPSS
0%
Exploit probability
Unpatched
6
Critical/High
Risk Level
39/100
low
🆕 3Fresh (<7d)📈 9 in Last 30 Days

Severity Distribution

Critical
2
High
6
Medium
22
Low
1

Exploit Likelihood

>50% chance
0
20-50%
0
5-20%
0
<5%
6

Age Distribution

Common Weaknesses (CWE)

1
XSS
9
2
CSRF
2
3
SQL Injection
2
4
Race Condition
1

Most Affected Products

1. YITH WooCommerce Gift Cards3
2. YITH YITH WooCommerce Product Add-Ons3
3. YITH WooCommerce Wishlist3
4. YITH PayPal Express Checkout for WooCommerce2
5. YITH YITH WooCommerce Product Bundles2

Recent Vulnerabilities

See more →
CVE-2026-88813
unknown

YITH WooCommerce Gift Cards <= 4.39.0 - Unauthenticated Gift Card Balance Inflation via Discounted Purchase

Nov 11, 2026🔧 No Patch
CVE-2026-121779
CVSS 5.3medium

WordPress YITH WooCommerce Subscription plugin <= 4.22.0 - Sensitive Data Exposure vulnerability

Nov 7, 2026🔧 No Patch
CVE-2026-88814
CVSS 3.7low

YITH WooCommerce Gift Cards < 4.38.1 - Unauthenticated Gift Card Balance Double-Spending via Race Condition

Nov 5, 2026🔧 No Patch
CVE-2026-27401
CVSS 5.3medium

WordPress YITH PayPal Express Checkout for WooCommerce plugin <= 1.62.0 - Broken Access Control vulnerability

Oct 29, 2026🔧 No Patch
CVE-2026-111845
CVSS 5.3medium

WordPress YITH WooCommerce Product Bundles plugin <= 2.29.0 - Broken Access Control vulnerability

Oct 19, 2026🔧 No Patch
CVE-2026-112199
CVSS 6.5medium

WordPress YITH WooCommerce Wishlist plugin <= 4.18.1 - Cross Site Scripting (XSS) vulnerability

Oct 19, 2026🔧 No Patch
CVE-2026-111409
CVSS 5.3medium

WordPress YITH PayPal Express Checkout for WooCommerce plugin <= 1.61.0 - Broken Access Control vulnerability

Oct 16, 2026🔧 No Patch
CVE-2026-106604
CVSS 6.5medium

WordPress YITH WooCommerce Compare plugin <= 3.15.0 - Cross Site Scripting (XSS) vulnerability

Oct 15, 2026🔧 No Patch
CVE-2026-92426
CVSS 4.9medium

YITH WooCommerce Popup < 1.60.0 - Contributor+ Arbitrary Post Meta Deletion

Oct 14, 2026🔧 No Patch
CVE-2026-66480
CVSS 5.3medium

WordPress YITH WooCommerce Product Add-Ons plugin <= 4.34.0 - Sensitive Data Exposure vulnerability

Oct 10, 2026🔧 No Patch

Monitor yith in Real-Time

Get instant alerts when new vulnerabilities are discovered. Stay ahead of security threats with SecAlerts.

Powered bySecAlerts

Monitor Your Software Stack in Real-Time

Get instant alerts when vulnerabilities are discovered in your software stack. Stay ahead of security threats with SecAlerts.

© 2026 SecAlerts Pty Ltd. All rights reserved.

yith Security Vulnerabilities & Risk Score | 32 CVEs | SecAlerts - SecAlerts