Vulnerabilities

TI-2024-07271 CVE-2024-7846 · GHSA-h5qj-jjhh-95x5

YITH WooCommerce Ajax Search < 2.7.1 - Contributor+ Stored XSS

MEDIUM 58

YITH WooCommerce Ajax Search is vulnerable to a XSS vulnerability due to insufficient sanitization of user supplied block attributes.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00331 Published 2024-09-23 Fixed in 2.7.1 CWE-79

TI-2024-04145 CVE-2024-4455

YITH WooCommerce Ajax Search <= 2.4.0 - Unauthenticated Stored Cross-Site Scripting

LOW 34

The YITH WooCommerce Ajax Search plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘item’ parameter in versions up to, and including, 2.4.0 due to insufficient input sanitization and output escapi…

CVSS 3.1HIGH 7.2 Network No auth No interaction EPSS 0.0101 Published 2024-05-24 No fix listed CWE-79

TI-2019-12233 CVE-2019-16251 · GHSA-rph9-hxwg-j95q

plugin-fw/lib/yit-plugin-panel-wc.php in the YIT Plugin Framework through 3.3.8 for…

LOW 22

plugin-fw/lib/yit-plugin-panel-wc.php in the YIT Plugin Framework through 3.3.8 for WordPress allows authenticated options changes.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00948 Published 2019-10-31 No fix listed

Vulnerabilities

Filters

YITH WooCommerce Ajax Search < 2.7.1 - Contributor+ Stored XSS

YITH WooCommerce Ajax Search <= 2.4.0 - Unauthenticated Stored Cross-Site Scripting

plugin-fw/lib/yit-plugin-panel-wc.php in the YIT Plugin Framework through 3.3.8 for…