CVE-2026-42383
HighCVSS 7.6Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
The YITH WooCommerce Product Add-Ons plugin up to version 4.29.0 contains a blind SQL injection vulnerability due to improper neutralization of special elements in SQL commands.
Risk Assessment
An attacker can steal data from the database, including customer and order data, without visible errors.
Recommendation
Update the plugin to version 4.30.0 or later, which includes the fix.
Other vulnerabilities in YITH WooCommerce Product Add-Ons
See all- CVE-2026-107868Medium
The YITH WooCommerce Product Add-Ons plugin in versions up to 4.34.0 contains an unauthenticated bypass vulnerability. The description does not specify the mechanism, but indicates a bypass flaw exploitable without authentication.
- CVE-2026-66480Medium
The YITH WooCommerce Product Add-Ons plugin up to version 4.34.0 exposes sensitive system information to unauthorized parties. The flaw allows retrieval of embedded sensitive data.
Original NVD description (English source)
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in YITH YITH WooCommerce Product Add-Ons allows Blind SQL Injection. This issue affects YITH WooCommerce Product Add-Ons: from n/a through 4.29.0.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS