Cross-site Scripting Vulnerability in YITH WooCommerce Ajax Product Filter by YITH
CVE-2026-125833

6.5MEDIUM

Key Information:

Vendor

WordPress
Status
Yith WooCommerce Ajax Product Filter
Vendor
CVE Published:
13 November 2026

What is CVE-2026-125833?

The YITH WooCommerce Ajax Product Filter plugin is susceptible to a stored Cross-site Scripting (XSS) vulnerability. It arises from improper input neutralization during web page generation, allowing attackers to inject malicious scripts. This could lead to unauthorized actions performed on behalf of users when they visit the compromised page, jeopardizing both user data and website integrity. It is critical for users of versions up to 5.24.0 of this plugin to update to secure versions to prevent exploitation.

Affected Version(s)

YITH WooCommerce Ajax Product Filter 0 <= 5.24.0

References

https://patchstack.com/database/wordpress/plugin/yith-woo...
vdb-entry

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

dzaku | Patchstack Bug Bounty Program
.