YITH WooCommerce Multi Vendor

YITH WooCommerce Multi Vendor has 4 disclosed vulnerabilities in the WordSec catalog, reported between 2019 and 2022; 2 are fixed and 2 remain unpatched as of September 2026. Their average CVSS score is 5.5, and the most serious one scores 7.1 out of 10. Severity breakdown: 0 critical and 1 high. 2022 was the busiest year with 2 disclosures.

The most common weakness is Missing Authorization, behind 2 of the records (50%). Other recurring categories include Cross-Site Request Forgery (CSRF), Cross-Site Scripting.

2 of the records (50%) have a vendor fix, while 2 remain unpatched. The oldest unresolved one dates back to 2022.

3 independent researchers contributed these findings, one record each.

Strategic Overview

Avg CVSSMedium

5.5/ 10

Patch Coverage50%

Open

Fixed

Get automatic notifications for all YITH WooCommerce Multi Vendor vulnerabilities before they are exploited.

Most severe open issueCVSS 7.1

YITH plugins by YITHEMES <= (Various Versions) - Missing Authorization

Read the full analysis

Vulnerability Records

4 records


2022-11-11 00:00	YITH plugins by YITHEMES <= (Various Versions) - Missing Authorization YITH WooCommerce Multi Vendor <= 3.9.0	`N/A`	7.1 High	Anonymous	No
2022-11-11 00:00	YITH plugins by YITHEMES <= (Various Versions) - Cross-Site Request Forgery YITH WooCommerce Multi Vendor <= 3.9.0	`CVE-2022-44630`	4.3 Medium	István Márton	No
2021-10-11 00:00	YITH WooCommerce Multi Vendor <= 3.8.0 - Reflected Cross-Site Scripting YITH WooCommerce Multi Vendor < 3.8.1	`N/A`	6.1 Medium	WPScanTeam	Yes
2019-10-31 00:00	YIT Plugin Framework <= 3.3.8 - Authenticated Settings Change YITH WooCommerce Multi Vendor <= 3.4.0	`CVE-2019-16251`	4.3 Medium	Jerome Bruandet	Yes

Showing 1–4 of 4 reports