{"id":"CVE-2026-125833","kind":"vulnerability","aliases":["CVE-2026-125833"],"related":[],"title":"YITH WooCommerce Ajax Product Filter: stored XSS through version 5.24.0","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in YITH YITH WooCommerce Ajax Product Filter yith-woocommerce-ajax-navigation allows Stored XSS.This issue affects YITH WooCommerce Ajax Product Filter: from n/a through 5.24.0.","summary":"The YITH WooCommerce Ajax Product Filter WordPress plugin has a stored cross-site scripting flaw in versions through 5.24.0. An attacker who can get script stored in the plugin's data can run it in the browser of other visitors or admins.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","woocommerce","wordpress","yith"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed plugin version in the WordPress admin under Plugins, or in the plugin header of `yith-woocommerce-ajax-navigation/init.php`.\n- Look for the plugin being active on a WooCommerce store.","fix":"- YITH WooCommerce Ajax Product Filter: a fixed version is not named in the sources; move to a release later than `5.24.0` once the vendor publishes it.","status":"open","published_at":"2026-11-13T13:18:21+00:00","first_seen_at":"2026-11-13T13:46:52+00:00","triaged_at":"2026-11-13T13:47:54+00:00","updated_at":"2026-11-13T13:47:54+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-13T13:47:54Z","model":"claude-haiku-5-5","output":{"fix":"- YITH WooCommerce Ajax Product Filter: a fixed version is not named in the sources; move to a release later than `5.24.0` once the vendor publishes it.","reach":"internet","title":"YITH WooCommerce Ajax Product Filter: stored XSS through version 5.24.0","impact":"medium","summary":"The YITH WooCommerce Ajax Product Filter WordPress plugin has a stored cross-site scripting flaw in versions through 5.24.0. An attacker who can get script stored in the plugin's data can run it in the browser of other visitors or admins.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","woocommerce","yith"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"script runs in visitors' and admins' browsers on the store","analyst_note":"Confirm the fixed version and the exact input that gets stored, from the YITH advisory or the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-125833.","how_to_check":"- Check the installed plugin version in the WordPress admin under Plugins, or in the plugin header of `yith-woocommerce-ajax-navigation/init.php`.\n- Look for the plugin being active on a WooCommerce store.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"WooCommerce stores running the YITH WooCommerce Ajax Product Filter plugin at version 5.24.0 or earlier are exposed. The sources do not describe the exact input path or required role, so the team should assume any storefront or admin page rendering the filter output is in scope.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000774,"input_tokens":4579,"output_tokens":633,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-125833':13A,16A '-2026':12A,15A '5.24.0':10A,40B,102C 'admin':63B 'affect':93C 'ajax':3A,24B,81C,87C,96C 'allow':89C 'attack':42B 'browser':58B 'cross':33B,73C 'cross-sit':32B,72C 'cve':11A,14A 'data':52B 'filter':5A,26B,83C,98C 'flaw':36B 'generat':71C 'get':45B 'improp':64C 'input':67C 'issu':92C 'n/a':100C 'navig':88C 'neutral':65C 'packag':17B 'page':70C 'plugin':28B,50B 'product':4A,25B,82C,97C 'run':54B 'script':35B,46B,75C 'site':34B,74C 'store':6A,31B,47B,90C 'version':9A,38B 'visitor':61B 'vulner':76C 'web':69C 'woocommerc':2A,18B,23B,80C,86C,95C 'wordpress':19B,27B 'xss':7A 'xss.this':91C 'yith':1A,20B,22B,78C,79C,85C,94C 'yith-woocommerce-ajax-navig':84C","nicknames":[],"mitigations":[],"who_affected":"WooCommerce stores running the YITH WooCommerce Ajax Product Filter plugin at version 5.24.0 or earlier are exposed. The sources do not describe the exact input path or required role, so the team should assume any storefront or admin page rendering the filter output is in scope.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","package","woocommerce","wordpress","yith"],"campaign_type":null,"search_a":"'-125833':13A,16A '-2026':12A,15A '5.24.0':10A 'ajax':3A 'cve':11A,14A 'filter':5A 'product':4A 'store':6A 'version':9A 'woocommerc':2A 'xss':7A 'yith':1A","search_b":"'5.24.0':40B 'admin':63B 'ajax':24B 'attack':42B 'browser':58B 'cross':33B 'cross-sit':32B 'data':52B 'filter':26B 'flaw':36B 'get':45B 'packag':17B 'plugin':28B,50B 'product':25B 'run':54B 'script':35B,46B 'site':34B 'store':31B,47B 'version':38B 'visitor':61B 'woocommerc':18B,23B 'wordpress':19B,27B 'yith':20B,22B","search_c":"'5.24.0':102C 'affect':93C 'ajax':81C,87C,96C 'allow':89C 'cross':73C 'cross-sit':72C 'filter':83C,98C 'generat':71C 'improp':64C 'input':67C 'issu':92C 'n/a':100C 'navig':88C 'neutral':65C 'page':70C 'product':82C,97C 'script':75C 'site':74C 'store':90C 'vulner':76C 'web':69C 'woocommerc':80C,86C,95C 'xss.this':91C 'yith':78C,79C,85C,94C 'yith-woocommerce-ajax-navig':84C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T13:18:21+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125833","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125833","severity":null,"published_at":"2026-11-13T13:18:21+00:00","modified_at":"2026-11-13T13:18:21+00:00","first_seen_at":"2026-11-13T13:46:52+00:00","fetched_at":"2026-11-13T13:46:52+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}