¿Es seguro Yith Woocommerce Ajax Search?

Qué hace este plugin

• Slug: yith-woocommerce-ajax-search
• 30000+ instalaciones activas

woocommerce search by skuwoocommerce search formwoocommerce search pagewoocommerce search resultswoocommerce search shortcode

Estado de mantenimiento

• Última versión conocida: 2.26.0
• Requiere PHP: 7.4+

Vulnerabilidades conocidas

5 CVEs conocidos registrados para Yith Woocommerce Ajax Search. Reportadas entre 2019 y 2024.

CVE-2024-47350

The YITH WooCommerce Ajax Search plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 2.8.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

CVE-2024-7846

The YITH WooCommerce Ajax Search plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.7.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

CVE-2024-4455

The YITH WooCommerce Ajax Search plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘item’ parameter in versions up to, and including, 2.4.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

YITH WooCommerce Ajax Search [yith-woocommerce-ajax-search] < 1.25.1

Several YITHEMES plugins for WordPress are vulnerable to authorization bypass due to a missing capability check on the create_log_file function. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to download the logs of the plugin which can contain sensitive information. Please note that the unpatched plugins from this developer are the FREE versions of the plugin that were available on the WordPress.org repository. The developer is still maintaining the premium versions of the plugins which have been patched.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

CVE-2022-44630

Several YITHEMES plugins for WordPress are vulnerable to Cross-Site Request Forgery. This is due to missing or incorrect nonce validation on the create_log_file function. This makes it possible for unauthenticated attackers to create an error or debug log file using the plugin, via forged request granted they can trick a site administrator into performing an action such as clicking on a link. The function allows the user to specify the file name. Please note that the unpatched plugins from this developer are the FREE versions of the plugin that were available on the WordPress.org repository. The developer is still maintaining the premium versions of the plugins which have been patched.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

CVE-2019-16251

Various versions of a various YITH WooCommerce plugins that use the YIT Plugin Framework through 3.3.8 are vulnerable to authorization bypass due to a missing capability check in the the 'save_toggle_element_options' function in .plugin-fw/lib/yit-plugin-panel-wc.php. This allows authenticated users with subscriber-level permissions or above to change arbitrary plugin settings.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

YITH WooCommerce Ajax Search [yith-woocommerce-ajax-search] < 1.25.1

Update the WordPress YITH WooCommerce Ajax Search plugin to the latest available version (at least 1.25.1). Lana Codes discovered and reported this Cross Site Request Forgery (CSRF) vulnerability in WordPress YITH WooCommerce Ajax Search Plugin. This could allow a malicious actor to force higher privileged users to execute unwanted actions under their current authentication. For example a password change which will then allow the malicious actor to login into the admin account. This vulnerability has been fixed in version 1.25.1.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

Cómo solucionarlo

Mantén Yith Woocommerce Ajax Search actualizado — 2.26.0 es la última versión en wordpress.org, y cada CVE de arriba indica la versión exacta que lo corrigió ("Corregido en").

Este es el historial completo de vulnerabilidades conocidas del plugin, no un escaneo de una instalación específica — ejecuta un escaneo gratis de tu propio sitio para verificar tu versión instalada exacta.