CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 0CVE-2024-35680 – WordPress YITH WooCommerce Product Add-Ons plugin <= 4.9.2 - Content Injection vulnerability
https://notcve.org/view.php?id=CVE-2024-35680
Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in YITH YITH WooCommerce Product Add-Ons allows Code Injection.This issue affects YITH WooCommerce Product Add-Ons: from n/a through 4.9.2. La neutralización inadecuada de elementos especiales en la salida utilizados por una vulnerabilidad de componente posterior ("inyección") en YITH YITH WooCommerce Product Add-Ons permite la inyección de código. Este problema afecta a YITH WooCommerce Product Add-Ons: desde n/a hasta 4.9.2. The YITH WooCommerce Product Add-Ons plugin for WordPress is vulnerable to Content Injection in all versions up to, and including, 4.9.2. This is due to the plugin not properly validating a field that can be updated. • https://patchstack.com/database/vulnerability/yith-woocommerce-product-add-ons/wordpress-yith-woocommerce-product-add-ons-plugin-4-9-2-content-injection-vulnerability?_s_id=cve • CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') •
CVSS: 9.1EPSS: 0%CPEs: 1EXPL: 0CVE-2023-49777 – WordPress YITH WooCommerce Product Add-Ons Plugin <= 4.3.0 is vulnerable to PHP Object Injection
https://notcve.org/view.php?id=CVE-2023-49777
Deserialization of Untrusted Data vulnerability in YITH YITH WooCommerce Product Add-Ons.This issue affects YITH WooCommerce Product Add-Ons: from n/a through 4.3.0. Vulnerabilidad de deserialización de datos no confiables en YITH YITH WooCommerce Product Add-Ons. Este problema afecta a YITH WooCommerce Product Add-Ons: desde n/a hasta 4.3.0. The YITH WooCommerce Product Add-Ons plugin for WordPress is vulnerable to PHP Object Injection in all versions up to 4.3.1 (exclusive) via deserialization of untrusted input in the 'save_addon' function. This makes it possible for authenticated attackers, with Shop Manager access and above, to inject a PHP Object. • https://patchstack.com/database/vulnerability/yith-woocommerce-product-add-ons/wordpress-yith-woocommerce-product-add-ons-extra-options-plugin-4-3-0-php-object-injection-vulnerability?_s_id=cve • CWE-502: Deserialization of Untrusted Data •
CVSS: 4.3EPSS: 0%CPEs: 38EXPL: 0CVE-2019-16251 – YIT Plugin Framework <= 3.3.8 - Authenticated Settings Change
https://notcve.org/view.php?id=CVE-2019-16251
plugin-fw/lib/yit-plugin-panel-wc.php in the YIT Plugin Framework through 3.3.8 for WordPress allows authenticated options changes. el archivo plugin-fw/lib/yit-plugin-panel-wc.php en YIT Plugin Framework versiones hasta 3.3.8 para WordPress, permite cambios de opciones autenticados. Various versions of a various YITH WooCommerce plugins that use the YIT Plugin Framework through 3.3.8 are vulnerable to authorization bypass due to a missing capability check in the the 'save_toggle_element_options' function in .plugin-fw/lib/yit-plugin-panel-wc.php. This allows authenticated users with subscriber-level permissions or above to change arbitrary plugin settings. • https://blog.nintechnet.com/authenticated-settings-change-vulnerability-in-yit-plugin-framework https://wpvulndb.com/vulnerabilities/9932 • CWE-862: Missing Authorization •