Plugin security history

YITH WooCommerce Product Add-Ons Vulnerability History & Security Timeline

The Wordfence Intelligence dataset currently contains 10 vulnerability records associated with YITH WooCommerce Product Add-Ons, published between 2019 and 2026.

Dataset last synchronized: 2026-08-03 00:31:25 UTC

At a glance

Security Snapshot

10Total records

0Critical

1High

9Medium

0Low

0Informational

10Patched records

0Currently marked unpatched

2019-10-31First disclosure

2026-05-20Latest disclosure

9 of 10CVE coverage

Year-by-Year Timeline

Year	Records	Relative volume
2019	1	1 records
2022	2	2 records
2023	2	2 records
2024	4	4 records
2026	1	1 records

Severity Breakdown

Severity	Records	Share
High	1	10%
Medium	9	90%

Vulnerability-Type Breakdown

Missing Authorization

3 records30%

First: 2019. Latest: 2023.

Cross-Site Scripting

3 records30%

First: 2024. Latest: 2024.

Other

2 records20%

First: 2023. Latest: 2024.

CSRF

1 record10%

First: 2022. Latest: 2022.

SQL Injection

1 record10%

First: 2026. Latest: 2026.

Patch Status

Patched: 10
Currently marked unpatched: 0
Unknown status: 0

Patch status reflects the latest successfully synchronized source dataset and must be checked against the installed version.

Latest Known Patched Versions

4.29.1
4.14.2
4.13.1
4.9.3
4.6.0
4.3.1
4.2.1
2.16.0
1.5.23

Affected-Version History

Ranges are deduplicated by source range record and shown with the associated disclosure and known patched versions.

Affected range	Vulnerability	Published	Patched version	Severity
`*-4.29.0`	YITH WooCommerce Product Add-Ons <= 4.29.0 - Authenticated (Shop manager+) SQL Injection	May 20, 2026	4.29.1	Medium
`*-4.14.1`	YITH WooCommerce Product Add-Ons <= 4.14.1 - Reflected Cross-Site Scripting	October 24, 2024	4.14.2	Medium
`*-4.13.0`	YITH WooCommerce Product Add-Ons <= 4.13.0 - Reflected Cross-Site Scripting	September 30, 2024	4.13.1	Medium
`*-4.9.2`	YITH WooCommerce Product Add-Ons <= 4.9.2 - Unauthenticated Content Injection	June 6, 2024	4.9.3	Medium
`*-4.5.0`	YITH WooCommerce Product Add-Ons <= 4.5.0 - Unuathenticated Cross-Site Scripting	March 15, 2024	4.6.0	Medium
`[*, 4.3.1)`	YITH WooCommerce Product Add-Ons <= 4.3.0 - Authenticated(Shop Manager+) PHP Object Injection	December 28, 2023	4.3.1	Medium
`*-4.2.0`	YITH WooCommerce Product Add-Ons <= 4.2.0 - Missing Authorization	October 25, 2023	4.2.1	Medium
`*-2.15.0`	YITH plugins by YITHEMES <= (Various Versions) - Cross-Site Request Forgery	November 11, 2022	2.16.0	Medium
`*-2.15.0`	YITH plugins by YITHEMES <= (Various Versions) - Missing Authorization	November 11, 2022	2.16.0	High
`*-1.5.21`	YIT Plugin Framework <= 3.3.8 - Authenticated Settings Change	October 31, 2019	1.5.23	Medium

Selected source records

Latest Records

MediumCVE-2026-42383

YITH WooCommerce Product Add-Ons <= 4.29.0 - Authenticated (Shop manager+) SQL Injection

Published: May 20, 2026

Affected versions: *-4.29.0
Patched versions: 4.29.1

Original Wordfence record

MediumCVE-2024-50448

YITH WooCommerce Product Add-Ons <= 4.14.1 - Reflected Cross-Site Scripting

Published: October 24, 2024

Affected versions: *-4.14.1
Patched versions: 4.14.2

Original Wordfence record

MediumCVE-2024-47367

YITH WooCommerce Product Add-Ons <= 4.13.0 - Reflected Cross-Site Scripting

Published: September 30, 2024

Affected versions: *-4.13.0
Patched versions: 4.13.1

Original Wordfence record

MediumCVE-2024-35680

YITH WooCommerce Product Add-Ons <= 4.9.2 - Unauthenticated Content Injection

Published: June 6, 2024

Affected versions: *-4.9.2
Patched versions: 4.9.3

Original Wordfence record

MediumCVE-2024-27994

YITH WooCommerce Product Add-Ons <= 4.5.0 - Unuathenticated Cross-Site Scripting

Published: March 15, 2024

Affected versions: *-4.5.0
Patched versions: 4.6.0

Original Wordfence record

MediumCVE-2023-49777

YITH WooCommerce Product Add-Ons <= 4.3.0 - Authenticated(Shop Manager+) PHP Object Injection

Published: December 28, 2023

Affected versions: [*, 4.3.1)
Patched versions: 4.3.1

Original Wordfence record

MediumCVE-2023-46635

YITH WooCommerce Product Add-Ons <= 4.2.0 - Missing Authorization

Published: October 25, 2023

Affected versions: *-4.2.0
Patched versions: 4.2.1

Original Wordfence record

High

YITH plugins by YITHEMES <= (Various Versions) - Missing Authorization

Published: November 11, 2022

Affected versions: *-1.2.27
Patched versions: Not supplied

Affected versions: *-2.14.0
Patched versions: 2.15.0

Affected versions: *-1.21.0
Patched versions: 1.21.1

Affected versions: *-2.10.0
Patched versions: 2.11.0

Affected versions: *-2.15.0
Patched versions: 2.16.0

Affected versions: *-1.17.0
Patched versions: 1.17.1

Affected versions: *-1.5.0
Patched versions: Not supplied

Affected versions: *-1.2.6
Patched versions: Not supplied

Affected versions: *-1.3.0
Patched versions: Not supplied

Affected versions: *-2.7.0
Patched versions: 2.8.0

Affected versions: *-1.8.0
Patched versions: Not supplied

Affected versions: *-2.16.0
Patched versions: 2.16.1

Affected versions: *-1.20.0
Patched versions: 1.20.1

Affected versions: *-4.15.0
Patched versions: 4.16.0

Affected versions: *-3.14.0
Patched versions: 3.15.0

Affected versions: *-2.0.17
Patched versions: Not supplied

Affected versions: *-1.9.0
Patched versions: Not supplied

Affected versions: *-1.3.0
Patched versions: Not supplied

Affected versions: *-2.20.0
Patched versions: 2.20.1

Affected versions: *-1.25.0
Patched versions: 1.25.1

Affected versions: *-1.25.0
Patched versions: 1.25.1

Affected versions: *-2.13.0
Patched versions: 2.14.0

Affected versions: *-2.5.0
Patched versions: Not supplied

Affected versions: *-1.7.0
Patched versions: 1.8.0

Affected versions: *-3.9.0
Patched versions: Not supplied

Affected versions: *-2.5.0
Patched versions: 2.6.0

Affected versions: *-1.16.0
Patched versions: 1.17.0

Affected versions: *-2.15.0
Patched versions: 2.15.1

Affected versions: *-1.21.0
Patched versions: 1.21.1

Affected versions: *-1.3.0
Patched versions: Not supplied

Affected versions: *-1.6.0
Patched versions: Not supplied

Affected versions: *-2.5.0
Patched versions: 2.6.0

Affected versions: *-2.14.0
Patched versions: 2.15.0

Affected versions: *-1.3.1
Patched versions: Not supplied

Affected versions: *-1.6.1
Patched versions: Not supplied

Affected versions: *-2.0.5
Patched versions: Not supplied

Affected versions: *-1.8.0
Patched versions: Not supplied

Affected versions: *-1.16.0
Patched versions: 1.16.1

Affected versions: *-2.16.0
Patched versions: 2.16.1

Affected versions: *-2.7.0
Patched versions: 2.8.0

Affected versions: *-1.21.0
Patched versions: 1.21.1

Affected versions: *-1.7.0
Patched versions: Not supplied

Affected versions: *-1.18.0
Patched versions: 1.19.1

Affected versions: *-1.18.0
Patched versions: 1.18.1

Affected versions: *-1.4.9
Patched versions: Not supplied

Original Wordfence record

Highest-Severity Records

High

YITH plugins by YITHEMES <= (Various Versions) - Missing Authorization

Published: November 11, 2022

Affected versions: *-1.2.27
Patched versions: Not supplied

Affected versions: *-2.14.0
Patched versions: 2.15.0

Affected versions: *-1.21.0
Patched versions: 1.21.1

Affected versions: *-2.10.0
Patched versions: 2.11.0

Affected versions: *-2.15.0
Patched versions: 2.16.0

Affected versions: *-1.17.0
Patched versions: 1.17.1

Affected versions: *-1.5.0
Patched versions: Not supplied

Affected versions: *-1.2.6
Patched versions: Not supplied

Affected versions: *-1.3.0
Patched versions: Not supplied

Affected versions: *-2.7.0
Patched versions: 2.8.0

Affected versions: *-1.8.0
Patched versions: Not supplied

Affected versions: *-2.16.0
Patched versions: 2.16.1

Affected versions: *-1.20.0
Patched versions: 1.20.1

Affected versions: *-4.15.0
Patched versions: 4.16.0

Affected versions: *-3.14.0
Patched versions: 3.15.0

Affected versions: *-2.0.17
Patched versions: Not supplied

Affected versions: *-1.9.0
Patched versions: Not supplied

Affected versions: *-1.3.0
Patched versions: Not supplied

Affected versions: *-2.20.0
Patched versions: 2.20.1

Affected versions: *-1.25.0
Patched versions: 1.25.1

Affected versions: *-1.25.0
Patched versions: 1.25.1

Affected versions: *-2.13.0
Patched versions: 2.14.0

Affected versions: *-2.5.0
Patched versions: Not supplied

Affected versions: *-1.7.0
Patched versions: 1.8.0

Affected versions: *-3.9.0
Patched versions: Not supplied

Affected versions: *-2.5.0
Patched versions: 2.6.0

Affected versions: *-1.16.0
Patched versions: 1.17.0

Affected versions: *-2.15.0
Patched versions: 2.15.1

Affected versions: *-1.21.0
Patched versions: 1.21.1

Affected versions: *-1.3.0
Patched versions: Not supplied

Affected versions: *-1.6.0
Patched versions: Not supplied

Affected versions: *-2.5.0
Patched versions: 2.6.0

Affected versions: *-2.14.0
Patched versions: 2.15.0

Affected versions: *-1.3.1
Patched versions: Not supplied

Affected versions: *-1.6.1
Patched versions: Not supplied

Affected versions: *-2.0.5
Patched versions: Not supplied

Affected versions: *-1.8.0
Patched versions: Not supplied

Affected versions: *-1.16.0
Patched versions: 1.16.1

Affected versions: *-2.16.0
Patched versions: 2.16.1

Affected versions: *-2.7.0
Patched versions: 2.8.0

Affected versions: *-1.21.0
Patched versions: 1.21.1

Affected versions: *-1.7.0
Patched versions: Not supplied

Affected versions: *-1.18.0
Patched versions: 1.19.1

Affected versions: *-1.18.0
Patched versions: 1.18.1

Affected versions: *-1.4.9
Patched versions: Not supplied

Original Wordfence record

MediumCVE-2023-49777

YITH WooCommerce Product Add-Ons <= 4.3.0 - Authenticated(Shop Manager+) PHP Object Injection

Published: December 28, 2023

Affected versions: [*, 4.3.1)
Patched versions: 4.3.1

Original Wordfence record

MediumCVE-2024-50448

YITH WooCommerce Product Add-Ons <= 4.14.1 - Reflected Cross-Site Scripting

Published: October 24, 2024

Affected versions: *-4.14.1
Patched versions: 4.14.2

Original Wordfence record

MediumCVE-2024-27994

YITH WooCommerce Product Add-Ons <= 4.5.0 - Unuathenticated Cross-Site Scripting

Published: March 15, 2024

Affected versions: *-4.5.0
Patched versions: 4.6.0

Original Wordfence record

MediumCVE-2024-47367

YITH WooCommerce Product Add-Ons <= 4.13.0 - Reflected Cross-Site Scripting

Published: September 30, 2024

Affected versions: *-4.13.0
Patched versions: 4.13.1

Original Wordfence record

MediumCVE-2024-35680

YITH WooCommerce Product Add-Ons <= 4.9.2 - Unauthenticated Content Injection

Published: June 6, 2024

Affected versions: *-4.9.2
Patched versions: 4.9.3

Original Wordfence record

MediumCVE-2023-46635

YITH WooCommerce Product Add-Ons <= 4.2.0 - Missing Authorization

Published: October 25, 2023

Affected versions: *-4.2.0
Patched versions: 4.2.1

Original Wordfence record

MediumCVE-2026-42383

YITH WooCommerce Product Add-Ons <= 4.29.0 - Authenticated (Shop manager+) SQL Injection

Published: May 20, 2026

Affected versions: *-4.29.0
Patched versions: 4.29.1

Original Wordfence record

View all associated vulnerabilities

Need help reviewing an exposed WordPress website?

Running an affected version does not prove that a website was compromised. Suspicious redirects, unknown administrators, injected content, unexpected files or recurring malware may require a manual investigation.

WordPress Malware Removal WordPress Security Maintenance Contact 3Zero Digital

Vulnerability data: Wordfence Intelligence. Analysis and practical guidance: 3Zero Digital.

Data Source, Attribution and Methodology

This page aggregates active Production Feed records. Counts are not software-quality rankings, and an affected version does not prove exploitation or infection. Read the full methodology.

Return to the Security History Directory