CVE-2019-16251: Yithemes Yith Advanced Refund System For Woocommerce

Medium severity, CVSS 4.3. EPSS: 0.9% chance of exploitation in the next 30 days.

plugin-fw/lib/yit-plugin-panel-wc.php in the YIT Plugin Framework through 3.3.8 for WordPress allows authenticated options changes.

Affected products

  • Yithemes Yith Advanced Refund System For Woocommerce: up to and including 1.0.10
  • Yithemes Yith Color And Label Variations For Woocommerce: up to and including 1.8.11
  • Yithemes Yith Custom Thank You Page For Woocommerce: up to and including 1.1.6
  • Yithemes Yith Desktop Notifications For Woocommerce: up to and including 1.2.7
  • Yithemes Yith PayPal Express Checkout For Woocommerce: up to and including 1.2.5
  • Yithemes Yith Pre-Order For Woocommerce: up to and including 1.1.9
  • Yithemes Yith Product Size Charts For Woocommerce: up to and including 1.1.1
  • Yithemes Yith Woocommerce Added To Cart Popup: up to and including 1.3.11
  • Yithemes Yith Woocommerce Advanced Reviews: up to and including 1.3.9
  • Yithemes Yith Woocommerce Affiliates: up to and including 1.6.3
  • Yithemes Yith Woocommerce AJAX Search: up to and including 1.6.9
  • Yithemes Yith Woocommerce Authorize.net Payment Gateway: up to and including 1.1.12
  • Yithemes Yith Woocommerce Badge Management: up to and including 1.3.19
  • Yithemes Yith Woocommerce Best Sellers: up to and including 1.1.11
  • Yithemes Yith Woocommerce Brands Add-On: up to and including 1.3.6
  • Yithemes Yith Woocommerce Bulk Product Editing: up to and including 1.2.13
  • Yithemes Yith Woocommerce Cart Messages: up to and including 1.4.3
  • Yithemes Yith Woocommerce Compare: up to and including 2.3.13
  • Yithemes Yith Woocommerce Frequently Bought Together: up to and including 1.2.10
  • Yithemes Yith Woocommerce Gift Cards: up to and including 1.3.7
  • Yithemes Yith Woocommerce Mailchimp: up to and including 2.1.3
  • Yithemes Yith Woocommerce Multi-Step Checkout: up to and including 1.7.4
  • Yithemes Yith Woocommerce Multi Vendor: up to and including 3.4.0
  • Yithemes Yith Woocommerce Order Tracking: up to and including 1.2.10
  • Yithemes Yith Woocommerce PDF Invoice And Shipping List: up to and including 1.2.12
  • and 13 more

Published 2019-10-31. Last modified 2026-06-17.