SecAlerts
y

yith

Security Risk Profile

45
/100
medium

Security Risk Score

Comprehensive risk assessment based on 24 vulnerabilities, EPSS scores, exploitation status, and remediation availability.

📅 Data spans from March 21, 2024 to present

24
Total CVEs
8
Critical+High
0
Exploited
6
Unpatched

Threat Assessment

Avg CVSS
6.5
Base severity
Avg EPSS
0%
Exploit probability
Unpatched
6
Critical/High
Risk Level
45/100
medium
🆕 4Fresh (<7d)📈 7 in Last 30 Days

Severity Distribution

Critical
2
High
6
Medium
15
Low
0

Exploit Likelihood

>50% chance
0
20-50%
0
5-20%
0
<5%
6

Age Distribution

Common Weaknesses (CWE)

1
XSS
7
2
CSRF
2
3
SQL Injection
2

Most Affected Products

1. YITH YITH WooCommerce Product Add-Ons3
2. YITH WooCommerce Wishlist3
3. YITH YITH WooCommerce Ajax Search2
4. YITH WooCommerce Ajax Search2
5. YITHEMES Yith Woocommerce Ajax Search Wordpress2

Recent Vulnerabilities

See more →
CVE-2026-92426
unknown

YITH WooCommerce Popup < 1.60.0 - Contributor+ Arbitrary Post Meta Deletion

Oct 14, 2026🔧 No Patch
CVE-2026-66480
CVSS 5.3medium

WordPress YITH WooCommerce Product Add-Ons plugin <= 4.34.0 - Sensitive Data Exposure vulnerability

Oct 10, 2026🔧 No Patch
CVE-2026-106606
CVSS 7.2high

WordPress YITH WooCommerce Affiliates plugin <= 3.31.0 - PHP Object Injection vulnerability

Oct 10, 2026🔧 No Patch
CVE-2026-105878
CVSS 5.3medium

WordPress YITH WooCommerce Product Bundles plugin <= 2.29.0 - Broken Access Control vulnerability

Oct 8, 2026🔧 No Patch
CVE-2026-97292
CVSS 6.5EPSS 0%medium

WordPress YITH WooCommerce Tab Manager plugin <= 2.15.0 - Cross Site Scripting (XSS) vulnerability

Sep 30, 2026🔧 No Patch
CVE-2026-96352
CVSS 7.1high

WordPress YITH WooCommerce Ajax Search plugin <= 2.28.0 - Cross Site Scripting (XSS) vulnerability

Sep 30, 2026🔧 No Patch
CVE-2026-95602
CVSS 6.5EPSS 0%medium

WordPress YITH WooCommerce Request A Quote plugin < 4.46.1 - Insecure Direct Object References (IDOR) vulnerability

Sep 23, 2026🔧 No Patch
CVE-2026-14359
CVSS 8.8high

YITH WooCommerce Waitlist Premium <= 3.35.0 - Authenticated (Subscriber+) Privilege Escalation to Admin via wp_ajax_yith_wcwtl_add_user

Sep 9, 2026🔧 No Patch
CVE-2026-84238
CVSS 9.8critical

WordPress YITH Request a Quote for WooCommerce Premium plugin < 4.46.0 - Broken Access Control vulnerability

Sep 3, 2026🔧 No Patch
CVE-2022-44630
CVSS 4.6medium

WordPress YITH WooCommerce Product Slider Carousel plugin <= 1.16.0 - Cross-Site Request Forgery (CSRF)

Jun 11, 2026🔧 No Patch

Monitor yith in Real-Time

Get instant alerts when new vulnerabilities are discovered. Stay ahead of security threats with SecAlerts.

Powered bySecAlerts

Monitor Your Software Stack in Real-Time

Get instant alerts when vulnerabilities are discovered in your software stack. Stay ahead of security threats with SecAlerts.

© 2026 SecAlerts Pty Ltd. All rights reserved.