VulnCrest
Search
Create account
Report an incident
Radar sectionsDatabase
Check my site
WordPress plugin

YITH plugins by YITHEMES <= (Various Versions) — Cross-Site Request Forgery

CVE-2022-44630Published · Updated

Action summary

YITH WooCommerce Wishlist: Affected: ≤3.14.0Update to 3.15.0 or newer

YITH WooCommerce Waitlist: Affected: ≤1.21.0Update to 1.21.1 or newer

YITH WooCommerce Product Add-Ons: Affected: ≤2.15.0Update to 2.16.0 or newer

YITH WooCommerce Tab Manager: Affected: ≤1.17.0Update to 1.17.1 or newer

YITH WooCommerce Ajax Search: Affected: ≤1.25.0Update to 1.25.1 or newer

YITH Request a Quote for WooCommerce: Affected: ≤2.15.0Update to 2.15.1 or newer

YITH WooCommerce Compare: Affected: ≤2.20.0Update to 2.20.1 or newer

YITH WooCommerce Bulk Product Editing: Affected: ≤1.2.27No patch available

YITH WooCommerce Product Gallery & Image Zoom: Affected: ≤2.14.0Update to 2.15.0 or newer

YITH WooCommerce Badge Management: Affected: ≤2.10.0Update to 2.11.0 or newer

YITH WooCommerce Questions and Answers: Affected: ≤1.5.0No patch available

YITH WooCommerce Authorize.net Payment Gateway: Affected: ≤1.2.6No patch available

YITH WooCommerce Order & Shipment Tracking: Affected: ≤2.7.0Update to 2.8.0 or newer

YITH WooCommerce Cart Messages: Affected: ≤1.8.0No patch available

YITH WooCommerce Subscription: Affected: ≤2.16.0Update to 2.16.1 or newer

YITH PayPal Express Checkout for WooCommerce: Affected: ≤1.20.0Update to 1.20.1 or newer

YITH WooCommerce Stripe: Affected: ≤2.0.17No patch available

YITH Custom Thank You Page for WooCommerce: Affected: ≤1.9.0No patch available

YITH Color and Label Variations for WooCommerce: Affected: ≤1.25.0Update to 1.25.1 or newer

YITH WooCommerce Mailchimp: Affected: ≤2.5.0No patch available

YITH WooCommerce Multi Vendor: Affected: ≤3.9.0No patch available

YITH Pre-Order for WooCommerce: Affected: ≤2.5.0Update to 2.6.0 or newer

YITH WooCommerce Product Bundles: Affected: ≤1.16.0Update to 1.17.0 or newer

YITH WooCommerce PDF Invoice and Shipping List: Affected: ≤1.3.0No patch available

YITH WooCommerce Brands Add-On: Affected: ≤2.5.0Update to 2.6.0 or newer

YITH WooCommerce Gift Cards: Affected: ≤2.14.0Update to 2.15.0 or newer

YITH WooCommerce Points and Rewards: Affected: ≤1.6.1No patch available

YITH WooCommerce Multi-step Checkout: Affected: ≤2.0.5No patch available

YITH WooCommerce Added to Cart Popup: Affected: ≤1.8.0No patch available

YITH WooCommerce Affiliates: Affected: ≤2.7.0Update to 2.8.0 or newer

YITH WooCommerce Quick View: Affected: ≤1.21.0Update to 1.21.1 or newer

YITH WooCommerce Advanced Reviews: Affected: ≤1.7.0No patch available

YITH Frequently Bought Together for WooCommerce: Affected: ≤1.18.0Update to 1.19.1 or newer

YITH WooCommerce Social Login: Affected: ≤1.4.9No patch available

YITH WooCommerce Popup: Affected: ≤1.21.0Update to 1.21.1 or newer

YITH WooCommerce Name Your Price: Affected: ≤1.3.0No patch available

YITH WooCommerce Ajax Product Filter: Affected: ≤4.15.0Update to 4.16.0 or newer

YITH Donations for WooCommerce: Affected: ≤1.3.0No patch available

YITH Essential Kit for WooCommerce #1: Affected: ≤2.13.0Update to 2.14.0 or newer

YITH Infinite Scrolling: Affected: ≤1.7.0Update to 1.8.0 or newer

YITH WooCommerce Category Accordion: Affected: ≤1.6.0No patch available

YITH PayPal Payments for WooCommerce: Affected: ≤1.3.1No patch available

YITH WooCommerce Product Slider Carousel: Affected: ≤1.16.0Update to 1.16.1 or newer

YITH WooCommerce Catalog Mode: Affected: ≤2.16.0Update to 2.16.1 or newer

YITH WooCommerce Featured Video: Affected: ≤1.18.0Update to 1.18.1 or newer

What to do until a fix ships
Watch plugin
Severity
Medium4.3
CVSS
4.3
CVSS 3.1 · CNA (Wordfence)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
What does this vector mean?
AV:N Attack vector
Network
AC:L Attack complexity
Low
PR:N Privileges required
None
UI:R User interaction
Required
S:U Scope
Unchanged
C:L Confidentiality
Low
I:N Integrity
None
A:N Availability
None
Weakness
CWE-352 CSRF
Required access
No account needed
Exploit prediction (EPSS)
No score
CISA KEV
Not listed
On this page8

Am I affected?

YITH WooCommerce Wishlist yith-woocommerce-wishlist

  1. Affected≤ 3.14.0
  2. Patched in3.15.0

Update to 3.15.0 or newer.

You are affected if you run ≤ 3.14.0. Version 3.15.0 and later are not affected by this issue.

YITH WooCommerce Waitlist yith-woocommerce-waiting-list

  1. Affected≤ 1.21.0
  2. Patched in1.21.1

Update to 1.21.1 or newer.

You are affected if you run ≤ 1.21.0. Version 1.21.1 and later are not affected by this issue.

YITH WooCommerce Product Add-Ons yith-woocommerce-product-add-ons

  1. Affected≤ 2.15.0
  2. Patched in2.16.0

Update to 2.16.0 or newer.

You are affected if you run ≤ 2.15.0. Version 2.16.0 and later are not affected by this issue.

YITH WooCommerce Tab Manager yith-woocommerce-tab-manager

  1. Affected≤ 1.17.0
  2. Patched in1.17.1

Update to 1.17.1 or newer.

You are affected if you run ≤ 1.17.0. Version 1.17.1 and later are not affected by this issue.

YITH WooCommerce Ajax Search yith-woocommerce-ajax-search

  1. Affected≤ 1.25.0
  2. Patched in1.25.1

Update to 1.25.1 or newer.

You are affected if you run ≤ 1.25.0. Version 1.25.1 and later are not affected by this issue.

YITH Request a Quote for WooCommerce yith-woocommerce-request-a-quote

  1. Affected≤ 2.15.0
  2. Patched in2.15.1

Update to 2.15.1 or newer.

You are affected if you run ≤ 2.15.0. Version 2.15.1 and later are not affected by this issue.

YITH WooCommerce Compare yith-woocommerce-compare

  1. Affected≤ 2.20.0
  2. Patched in2.20.1

Update to 2.20.1 or newer.

You are affected if you run ≤ 2.20.0. Version 2.20.1 and later are not affected by this issue.

YITH WooCommerce Bulk Product Editing yith-woocommerce-bulk-product-editing

  1. Affected≤ 1.2.27
  2. PatchedNo fix yet

No patched version available.

You are affected if you run ≤ 1.2.27. No fixed version has been released.

YITH WooCommerce Product Gallery & Image Zoom yith-woocommerce-zoom-magnifier

  1. Affected≤ 2.14.0
  2. Patched in2.15.0

Update to 2.15.0 or newer.

You are affected if you run ≤ 2.14.0. Version 2.15.0 and later are not affected by this issue.

YITH WooCommerce Badge Management yith-woocommerce-badges-management

  1. Affected≤ 2.10.0
  2. Patched in2.11.0

Update to 2.11.0 or newer.

You are affected if you run ≤ 2.10.0. Version 2.11.0 and later are not affected by this issue.

YITH WooCommerce Questions and Answers yith-woocommerce-questions-and-answers

  1. Affected≤ 1.5.0
  2. PatchedNo fix yet

No patched version available.

You are affected if you run ≤ 1.5.0. No fixed version has been released.

YITH WooCommerce Authorize.net Payment Gateway yith-woocommerce-authorizenet-payment-gateway

  1. Affected≤ 1.2.6
  2. PatchedNo fix yet

No patched version available.

You are affected if you run ≤ 1.2.6. No fixed version has been released.

YITH WooCommerce Order & Shipment Tracking yith-woocommerce-order-tracking

  1. Affected≤ 2.7.0
  2. Patched in2.8.0

Update to 2.8.0 or newer.

You are affected if you run ≤ 2.7.0. Version 2.8.0 and later are not affected by this issue.

YITH WooCommerce Cart Messages yith-woocommerce-cart-messages

  1. Affected≤ 1.8.0
  2. PatchedNo fix yet

No patched version available.

You are affected if you run ≤ 1.8.0. No fixed version has been released.

YITH WooCommerce Subscription yith-woocommerce-subscription

  1. Affected≤ 2.16.0
  2. Patched in2.16.1

Update to 2.16.1 or newer.

You are affected if you run ≤ 2.16.0. Version 2.16.1 and later are not affected by this issue.

YITH PayPal Express Checkout for WooCommerce yith-paypal-express-checkout-for-woocommerce

  1. Affected≤ 1.20.0
  2. Patched in1.20.1

Update to 1.20.1 or newer.

You are affected if you run ≤ 1.20.0. Version 1.20.1 and later are not affected by this issue.

YITH WooCommerce Stripe yith-woocommerce-stripe

  1. Affected≤ 2.0.17
  2. PatchedNo fix yet

No patched version available.

You are affected if you run ≤ 2.0.17. No fixed version has been released.

YITH Custom Thank You Page for WooCommerce yith-custom-thank-you-page-for-woocommerce

  1. Affected≤ 1.9.0
  2. PatchedNo fix yet

No patched version available.

You are affected if you run ≤ 1.9.0. No fixed version has been released.

YITH Color and Label Variations for WooCommerce yith-color-and-label-variations-for-woocommerce

  1. Affected≤ 1.25.0
  2. Patched in1.25.1

Update to 1.25.1 or newer.

You are affected if you run ≤ 1.25.0. Version 1.25.1 and later are not affected by this issue.

YITH WooCommerce Mailchimp yith-woocommerce-mailchimp

  1. Affected≤ 2.5.0
  2. PatchedNo fix yet

No patched version available.

You are affected if you run ≤ 2.5.0. No fixed version has been released.

YITH WooCommerce Multi Vendor yith-woocommerce-product-vendors

  1. Affected≤ 3.9.0
  2. PatchedNo fix yet

No patched version available.

You are affected if you run ≤ 3.9.0. No fixed version has been released.

YITH Pre-Order for WooCommerce yith-pre-order-for-woocommerce

  1. Affected≤ 2.5.0
  2. Patched in2.6.0

Update to 2.6.0 or newer.

You are affected if you run ≤ 2.5.0. Version 2.6.0 and later are not affected by this issue.

YITH WooCommerce Product Bundles yith-woocommerce-product-bundles

  1. Affected≤ 1.16.0
  2. Patched in1.17.0

Update to 1.17.0 or newer.

You are affected if you run ≤ 1.16.0. Version 1.17.0 and later are not affected by this issue.

YITH WooCommerce PDF Invoice and Shipping List yith-woocommerce-pdf-invoice

  1. Affected≤ 1.3.0
  2. PatchedNo fix yet

No patched version available.

You are affected if you run ≤ 1.3.0. No fixed version has been released.

YITH WooCommerce Brands Add-On yith-woocommerce-brands-add-on

  1. Affected≤ 2.5.0
  2. Patched in2.6.0

Update to 2.6.0 or newer.

You are affected if you run ≤ 2.5.0. Version 2.6.0 and later are not affected by this issue.

YITH WooCommerce Gift Cards yith-woocommerce-gift-cards

  1. Affected≤ 2.14.0
  2. Patched in2.15.0

Update to 2.15.0 or newer.

You are affected if you run ≤ 2.14.0. Version 2.15.0 and later are not affected by this issue.

YITH WooCommerce Points and Rewards yith-woocommerce-points-and-rewards

  1. Affected≤ 1.6.1
  2. PatchedNo fix yet

No patched version available.

You are affected if you run ≤ 1.6.1. No fixed version has been released.

YITH WooCommerce Multi-step Checkout yith-woocommerce-multi-step-checkout

  1. Affected≤ 2.0.5
  2. PatchedNo fix yet

No patched version available.

You are affected if you run ≤ 2.0.5. No fixed version has been released.

YITH WooCommerce Added to Cart Popup yith-woocommerce-added-to-cart-popup

  1. Affected≤ 1.8.0
  2. PatchedNo fix yet

No patched version available.

You are affected if you run ≤ 1.8.0. No fixed version has been released.

YITH WooCommerce Affiliates yith-woocommerce-affiliates

  1. Affected≤ 2.7.0
  2. Patched in2.8.0

Update to 2.8.0 or newer.

You are affected if you run ≤ 2.7.0. Version 2.8.0 and later are not affected by this issue.

YITH WooCommerce Quick View yith-woocommerce-quick-view

  1. Affected≤ 1.21.0
  2. Patched in1.21.1

Update to 1.21.1 or newer.

You are affected if you run ≤ 1.21.0. Version 1.21.1 and later are not affected by this issue.

YITH WooCommerce Advanced Reviews yith-woocommerce-advanced-reviews

  1. Affected≤ 1.7.0
  2. PatchedNo fix yet

No patched version available.

You are affected if you run ≤ 1.7.0. No fixed version has been released.

YITH Frequently Bought Together for WooCommerce yith-woocommerce-frequently-bought-together

  1. Affected≤ 1.18.0
  2. Patched in1.19.1

Update to 1.19.1 or newer.

You are affected if you run ≤ 1.18.0. Version 1.19.1 and later are not affected by this issue.

YITH WooCommerce Social Login yith-woocommerce-social-login

  1. Affected≤ 1.4.9
  2. PatchedNo fix yet

No patched version available.

You are affected if you run ≤ 1.4.9. No fixed version has been released.

YITH WooCommerce Popup yith-woocommerce-popup

  1. Affected≤ 1.21.0
  2. Patched in1.21.1

Update to 1.21.1 or newer.

You are affected if you run ≤ 1.21.0. Version 1.21.1 and later are not affected by this issue.

YITH WooCommerce Name Your Price yith-woocommerce-name-your-price

  1. Affected≤ 1.3.0
  2. PatchedNo fix yet

No patched version available.

You are affected if you run ≤ 1.3.0. No fixed version has been released.

YITH WooCommerce Ajax Product Filter yith-woocommerce-ajax-navigation

  1. Affected≤ 4.15.0
  2. Patched in4.16.0

Update to 4.16.0 or newer.

You are affected if you run ≤ 4.15.0. Version 4.16.0 and later are not affected by this issue.

YITH Donations for WooCommerce yith-donations-for-woocommerce

  1. Affected≤ 1.3.0
  2. PatchedNo fix yet

No patched version available.

You are affected if you run ≤ 1.3.0. No fixed version has been released.

YITH Essential Kit for WooCommerce #1 yith-essential-kit-for-woocommerce-1

  1. Affected≤ 2.13.0
  2. Patched in2.14.0

Update to 2.14.0 or newer.

You are affected if you run ≤ 2.13.0. Version 2.14.0 and later are not affected by this issue.

YITH Infinite Scrolling yith-infinite-scrolling

  1. Affected≤ 1.7.0
  2. Patched in1.8.0

Update to 1.8.0 or newer.

You are affected if you run ≤ 1.7.0. Version 1.8.0 and later are not affected by this issue.

YITH WooCommerce Category Accordion yith-woocommerce-category-accordion

  1. Affected≤ 1.6.0
  2. PatchedNo fix yet

No patched version available.

You are affected if you run ≤ 1.6.0. No fixed version has been released.

YITH PayPal Payments for WooCommerce yith-paypal-payments-for-woocommerce

  1. Affected≤ 1.3.1
  2. PatchedNo fix yet

No patched version available.

You are affected if you run ≤ 1.3.1. No fixed version has been released.

YITH WooCommerce Product Slider Carousel yith-woocommerce-product-slider-carousel

  1. Affected≤ 1.16.0
  2. Patched in1.16.1

Update to 1.16.1 or newer.

You are affected if you run ≤ 1.16.0. Version 1.16.1 and later are not affected by this issue.

YITH WooCommerce Catalog Mode yith-woocommerce-catalog-mode

  1. Affected≤ 2.16.0
  2. Patched in2.16.1

Update to 2.16.1 or newer.

You are affected if you run ≤ 2.16.0. Version 2.16.1 and later are not affected by this issue.

YITH WooCommerce Featured Video yith-woocommerce-featured-video

  1. Affected≤ 1.18.0
  2. Patched in1.18.1

Update to 1.18.1 or newer.

You are affected if you run ≤ 1.18.0. Version 1.18.1 and later are not affected by this issue.

  • Check your version: in wp-admin go to Plugins → Installed Plugins and read the version under YITH WooCommerce Wishlist.
  • No admin access? Run a passive check of your site. It reads public files only.
  • No account is needed to exploit this. Treat any exposed site on an affected version as at risk.

What to do

  1. Update to version 3.15.0, or a newer patched version
  2. Update to version 1.21.1, or a newer patched version
  3. Update to version 2.16.0, or a newer patched version
  4. Update to version 1.17.1, or a newer patched version
  5. Update to version 1.25.1, or a newer patched version
  6. Update to version 2.15.1, or a newer patched version
  7. Update to version 2.20.1, or a newer patched version
  8. No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
  9. Update to version 2.15.0, or a newer patched version
  10. Update to version 2.11.0, or a newer patched version
  11. No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
  12. No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
  13. Update to version 2.8.0, or a newer patched version
  14. No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
  15. Update to version 2.16.1, or a newer patched version
  16. Update to version 1.20.1, or a newer patched version
  17. No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
  18. No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
  19. Update to version 1.25.1, or a newer patched version
  20. No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
  21. No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
  22. Update to version 2.6.0, or a newer patched version
  23. Update to version 1.17.0, or a newer patched version
  24. No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
  25. Update to version 2.6.0, or a newer patched version
  26. Update to version 2.15.0, or a newer patched version
  27. No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
  28. No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
  29. No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
  30. Update to version 2.8.0, or a newer patched version
  31. Update to version 1.21.1, or a newer patched version
  32. No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
  33. Update to version 1.19.1, or a newer patched version
  34. No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
  35. Update to version 1.21.1, or a newer patched version
  36. No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
  37. Update to version 4.16.0, or a newer patched version
  38. No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
  39. Update to version 2.14.0, or a newer patched version
  40. Update to version 1.8.0, or a newer patched version
  41. No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
  42. No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
  43. Update to version 1.16.1, or a newer patched version
  44. Update to version 2.16.1, or a newer patched version
  45. Update to version 1.18.1, or a newer patched version
  46. Rotate administrator passwords and application secrets if the site ran a vulnerable version while publicly reachable.
  47. Watch YITH WooCommerce Wishlist to get an email when the next vulnerability is published.

Advisory

Source description from Wordfence Intelligence, credited to István Márton.

Several YITHEMES plugins for WordPress are vulnerable to Cross-Site Request Forgery. This is due to missing or incorrect nonce validation on the create_log_file function. This makes it possible for unauthenticated attackers to create an error or debug log file using the plugin, via forged request granted they can trick a site administrator into performing an action such as clicking on a link. The function allows the user to specify the file name. Please note that the unpatched plugins from this developer are the FREE versions of the plugin that were available on the WordPress.org repository. The developer is still maintaining the premium versions of the plugins which have been patched.

Exploits & references

Proof-of-concept & detection

No public proof-of-concept or detection template is known for this vulnerability.

Advisories & patches

More in YITH WooCommerce Wishlist

All 12
More vulnerabilities in YITH WooCommerce Wishlist
SeverityVulnerabilityCVEPublished
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤4.18.1Update to 4.19.0
CVE-2026-112199
Medium5.3Missing Authorization
<4.18.1Update to 4.18.1
CVE-2026-82305
Medium5.3Unauthenticated Insecure Direct Object Reference
≤4.12.0Update to 4.13.0
CVE-2026-27329
Medium5.3Unauthenticated Insecure Direct Object Reference to Wishlist Rename
<4.13.0Update to 4.13.0
CVE-2026-4432
Medium5.3Unauthenticated Wishlist Token Disclosure to Wishlist Item Deletion
≤4.10.0Update to 4.10.1
CVE-2025-12777

Same weakness (CSRF)

All CSRF
Other CSRF vulnerabilities
SeverityVulnerabilityCVEPublished
High7.2Unauthenticated Stored Cross-Site Scripting via Comment User-Agent Header
EZ SQL Reports Shortcode Widget and DB Backup≤5.25.25Update to 5.26.45
CVE-2026-120688
Critical9.8Unauthenticated Arbitrary File Upload via File Upload via Public Form Submission
Chatterbug Forms – Fast, Flexible WordPress Form Builder≤1.0.2Update to 1.1
CVE-2026-125055
Critical9.8Unauthenticated PHP Object Injection to Remote Code Execution via 'form' Parameter
ELEX WordPress HelpDesk & Customer Ticketing System≤3.3.9Update to 3.4.0
CVE-2026-119077
Medium5.3Unauthenticated Sensitive Information Exposure in 'search' Parameter
Customer Reviews for WooCommerce≤5.127.0Update to 5.128.0
CVE-2026-121518

Timeline

  1. CVE published

    Severity medium, CVSS 4.3

  2. Record last updated

Sources & licenses

Wordfence record
Vulnerability data
Wordfence Intelligence. [object Object] Licensed under the CC BY-SA 4.0.
CVE® identifiers
[object Object]. Used under the CVE Program. CVE® is a registered trademark of The MITRE Corporation.
CVSS / CWE
National Vulnerability Database (NVD), shown unmodified. This product uses the NVD API but is not endorsed or certified by the NVD.
VulnCrest content
Summary, remediation guidance and page layout © VulnCrest. Not sourced from NVD.

How we use these sources

Search VulnCrest Radar

Jump to

Are you sure?