Threat Database

Threat Entry Updated 2026-11-06

YITH WooCommerce Gift Cards - Security Vulnerability (CVE-2026-88814)

The YITH WooCommerce Gift Cards WordPress plugin before 4.38.1 does not lock or atomically update a gift card's balance when it is redeemed at checkout, allowing an attacker who holds a gift card code to spend more than its funded value by submitting multiple checkouts for the same code at the same time.

PLUGIN YITH WooCommerce Gift Cards

CVE-2026-88814

LOW CVSS 3.7 2026-11-05

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

YITH WooCommerce Gift Cards - Broken Access Control (CVE-2024-0870)

The YITH WooCommerce Gift Cards plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'save_mail_status' and 'save_email_settings' functions in all versions up to, and including, 4.12.0. This makes it possible for unauthenticated attackers to modify WooCommerce settings.

PLUGIN YITH WooCommerce Gift Cards

CVE-2024-0870

MEDIUM CVSS 5.3 2024-05-14

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

Yith Woocommerce Gift Cards - Arbitrary File Upload (CVE-2022-45359)

Unauth. Arbitrary File Upload vulnerability in YITH WooCommerce Gift Cards premium plugin

PLUGIN Yith Woocommerce Gift Cards

CVE-2022-45359

CRITICAL CVSS 9.8 2022-12-06

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

Yith Woocommerce Gift Cards - Remote Code Execution (CVE-2021-3120)

An arbitrary file upload vulnerability in the YITH WooCommerce Gift Cards Premium plugin before 3.3.1 for WordPress allows remote attackers to achieve remote code execution on the operating system in the security context of the web server. In order to exploit this vulnerability, an attacker must be able to place a valid Gift Card product into the shopping cart. An uploaded file is placed at a predetermined path on the web server with a user-specified filename and extension. This occurs because the ywgc-upload-picture parameter can have a .php value even…

PLUGIN Yith Woocommerce Gift Cards

CVE-2021-3120

CRITICAL CVSS 9.8 2021-02-22

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

Yith Woocommerce Gift Cards - Security Vulnerability (CVE-2019-16251)

plugin-fw/lib/yit-plugin-panel-wc.php in the YIT Plugin Framework through 3.3.8 for WordPress allows authenticated options changes.

PLUGIN Yith Woocommerce Gift Cards

CVE-2019-16251

MEDIUM CVSS 4.3 2019-10-31

Risk Score

Open Full Technical Breakdown