CVE-2019-16251

MEDIO 4.3CVE-2019-16251 · Published 31/10/2019 · updated 17/06/2026

En resumen

CVE-2019-16251 es una vulnerabilidad MEDIO (CVSS 4.3) que afecta a yith advanced refund system for woocommerce (yithemes), yith color and label variations for woocommerce (yithemes), yith custom thank you page for woocommerce (yithemes).
Probabilidad de explotación en los próximos 30 días (EPSS): 0.95%, mayor que el 61.2% de las vulnerabilidades.
Aún no hay una versión corregida: sigue el aviso del fabricante en Referencias.

Package	Affected versions	Patched versions
yith advanced refund system for woocommerce yithemes	`≤ 1.0.10`	No fix yet
yith color and label variations for woocommerce yithemes	`≤ 1.8.11`	No fix yet
yith custom thank you page for woocommerce yithemes	`≤ 1.1.6`	No fix yet
yith desktop notifications for woocommerce yithemes	`≤ 1.2.7`	No fix yet
yith paypal express checkout for woocommerce yithemes	`≤ 1.2.5`	No fix yet
yith pre-order for woocommerce yithemes	`≤ 1.1.9`	No fix yet
yith product size charts for woocommerce yithemes	`≤ 1.1.1`	No fix yet
yith woocommerce added to cart popup yithemes	`≤ 1.3.11`	No fix yet
yith woocommerce advanced reviews yithemes	`≤ 1.3.9`	No fix yet
yith woocommerce affiliates yithemes	`≤ 1.6.3`	No fix yet
yith woocommerce ajax search yithemes	`≤ 1.6.9`	No fix yet
yith woocommerce authorize.net payment gateway yithemes	`≤ 1.1.12`	No fix yet
yith woocommerce badge management yithemes	`≤ 1.3.19`	No fix yet
yith woocommerce best sellers yithemes	`≤ 1.1.11`	No fix yet
yith woocommerce brands add-on yithemes	`≤ 1.3.6`	No fix yet
yith woocommerce bulk product editing yithemes	`≤ 1.2.13`	No fix yet
yith woocommerce cart messages yithemes	`≤ 1.4.3`	No fix yet
yith woocommerce compare yithemes	`≤ 2.3.13`	No fix yet
yith woocommerce frequently bought together yithemes	`≤ 1.2.10`	No fix yet
yith woocommerce gift cards yithemes	`≤ 1.3.7`	No fix yet
yith woocommerce mailchimp yithemes	`≤ 2.1.3`	No fix yet
yith woocommerce multi-step checkout yithemes	`≤ 1.7.4`	No fix yet
yith woocommerce multi vendor yithemes	`≤ 3.4.0`	No fix yet
yith woocommerce order tracking yithemes	`≤ 1.2.10`	No fix yet
yith woocommerce pdf invoice and shipping list yithemes	`≤ 1.2.12`	No fix yet
yith woocommerce points and rewards yithemes	`≤ 1.3.4`	No fix yet
yith woocommerce product add-ons yithemes	`≤ 1.5.21`	No fix yet
yith woocommerce product bundles yithemes	`≤ 1.1.15`	No fix yet
yith woocommerce questions and answers yithemes	`≤ 1.1.9`	No fix yet
yith woocommerce quick view yithemes	`≤ 1.3.13`	No fix yet
yith woocommerce recover abandoned cart yithemes	`≤ 1.3.2`	No fix yet
yith woocommerce request a quote yithemes	`≤ 1.4.7`	No fix yet
yith woocommerce social login yithemes	`≤ 1.3.4`	No fix yet
yith woocommerce stripe yithemes	`≤ 2.0.1`	No fix yet
yith woocommerce subscription yithemes	`≤ 1.3.4`	No fix yet
yith woocommerce waiting list yithemes	`≤ 1.3.9`	No fix yet
yith woocommerce wishlist yithemes	`≤ 2.2.13`	No fix yet
yith woocommerce zoom magnifier yithemes	`≤ 1.3.11`	No fix yet

Description

plugin-fw/lib/yit-plugin-panel-wc.php in the YIT Plugin Framework through 3.3.8 for WordPress allows authenticated options changes.

References

blog.nintechnet.com/authenticated-settings-change-vulnerability-in-yit-plugin-framework · Third Party Advisory
wpvulndb.com/vulnerabilities/9932 · Third Party Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free