CVE-2026-66480
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
The YITH WooCommerce Product Add-Ons plugin up to version 4.34.0 exposes sensitive system information to unauthorized parties. The flaw allows retrieval of embedded sensitive data.
Risk Assessment
An attacker could obtain confidential system information, potentially facilitating further attacks or breaching data confidentiality.
Recommendation
Update the YITH WooCommerce Product Add-Ons plugin to a version later than 4.34.0.
Other vulnerabilities in YITH WooCommerce Product Add-Ons
See all- CVE-2026-107868Medium
The YITH WooCommerce Product Add-Ons plugin in versions up to 4.34.0 contains an unauthenticated bypass vulnerability. The description does not specify the mechanism, but indicates a bypass flaw exploitable without authentication.
- CVE-2026-42383High
The YITH WooCommerce Product Add-Ons plugin up to version 4.29.0 contains a blind SQL injection vulnerability due to improper neutralization of special elements in SQL commands.
Original NVD description (English source)
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in YITH YITH WooCommerce Product Add-Ons allows Retrieve Embedded Sensitive Data. This issue affects YITH WooCommerce Product Add-Ons: from n/a through 4.34.0.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS