CVE-2026-66480

MediumCVSS 5.3

Published: 10/10/2026(UTC)Updated: 13/10/2026(UTC)Translated: 11/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.20%

9th percentile - higher than 9% of all known CVEs

Summary

The YITH WooCommerce Product Add-Ons plugin up to version 4.34.0 exposes sensitive system information to unauthorized parties. The flaw allows retrieval of embedded sensitive data.

Risk Assessment

An attacker could obtain confidential system information, potentially facilitating further attacks or breaching data confidentiality.

Recommendation

Update the YITH WooCommerce Product Add-Ons plugin to a version later than 4.34.0.

Other vulnerabilities in YITH WooCommerce Product Add-Ons

CVE-2026-42383High
The YITH WooCommerce Product Add-Ons plugin up to version 4.29.0 contains a blind SQL injection vulnerability due to improper neutralization of special elements in SQL commands.

Original NVD description (English source)

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in YITH YITH WooCommerce Product Add-Ons allows Retrieve Embedded Sensitive Data. This issue affects YITH WooCommerce Product Add-Ons: from n/a through 4.34.0.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS