YITH WooCommerce Product Add-Ons vulnerabilities

3 known CVE vulnerabilities in YITH WooCommerce Product Add-Ons, translated and rated.

CVE-2026-107868Medium
The YITH WooCommerce Product Add-Ons plugin in versions up to 4.34.0 contains an unauthenticated bypass vulnerability. The description does not specify the mechanism, but indicates a bypass flaw exploitable without authentication.
CVE-2026-66480Medium
The YITH WooCommerce Product Add-Ons plugin up to version 4.34.0 exposes sensitive system information to unauthorized parties. The flaw allows retrieval of embedded sensitive data.
CVE-2026-42383High
The YITH WooCommerce Product Add-Ons plugin up to version 4.29.0 contains a blind SQL injection vulnerability due to improper neutralization of special elements in SQL commands.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS