YITH WooCommerce Catalog Mode Security & Risk Analysis

wordpress.org/plugins/yith-woocommerce-catalog-mode

YITH WooCommerce Catalog Mode, a plugin for disabling sales in your e-commerce and turn it into an e-commerce into an online catalogue.

60K active installs v2.53.0 PHP 7.4+ WP 6.7+ Updated Feb 26, 2026
productsthemeswoocommercewoocommerce-catalog-mode-pluginwoocommerce-catalog-only
99
A · Safe
CVEs total1
Unpatched0
Last CVENov 11, 2022
Safety Verdict

Is YITH WooCommerce Catalog Mode Safe to Use in 2026?

Generally Safe

Score 99/100

YITH WooCommerce Catalog Mode has a strong security track record. Known vulnerabilities have been patched promptly.

1 known CVELast CVE: Nov 11, 2022Updated 1mo ago
Risk Assessment

The YITH WooCommerce Catalog Mode plugin, version 2.53.0, demonstrates a generally good security posture with several strengths. The plugin extensively uses prepared statements for SQL queries and shows a high percentage of properly escaped output, minimizing risks related to SQL injection and cross-site scripting (XSS). Nonce and capability checks are also implemented frequently, indicating an effort to protect against common WordPress attacks. The absence of critical or high severity taint flows and file operations further reinforces this positive outlook.

However, a significant concern arises from the presence of one unprotected AJAX handler within the plugin's attack surface. This handler could be a potential entry point for unauthenticated attackers, especially if it processes user-supplied data without proper validation or sanitization. While the static analysis did not reveal any unsanitized taint flows, the lack of authentication on an AJAX endpoint is a direct security weakness that needs attention.

The plugin's vulnerability history includes one previously known high-severity CVE, specifically related to missing authorization. While this CVE is currently unpatched, the pattern of past vulnerabilities points towards authorization as a recurring area of concern. The combination of a past authorization vulnerability and a currently unprotected AJAX handler suggests a need for careful review of authorization mechanisms within the plugin.

Key Concerns

  • Unprotected AJAX handler
  • Past high severity vulnerability (missing authorization)
Vulnerabilities
1

YITH WooCommerce Catalog Mode Security Vulnerabilities

CVEs by Year

1 CVE in 2022
2022
Patched Has unpatched

Severity Breakdown

High
1

1 total CVE

YITH plugins by YITHEMES <= (Various Versions) - Missing Authorization

Nov 11, 2022 Patched in 2.16.1 (438d)
Code Analysis
Analyzed Mar 16, 2026

YITH WooCommerce Catalog Mode Code Analysis

Dangerous Functions
0
Raw SQL Queries
0
5 prepared
Unescaped Output
88
1463 escaped
Nonce Checks
15
Capability Checks
18
File Operations
0
External Requests
7
Bundled Libraries
1

Bundled Libraries

Select2

SQL Query Safety

100% prepared5 total queries

Output Escaping

94% escaped1551 total outputs
Data Flows
All sanitized

Data Flow Analysis

13 flows
do_shortcode (plugin-fw\includes\builders\gutenberg\class-yith-gutenberg.php:279)
Source (user input) Sink (dangerous op) Sanitizer Transform Unsanitized Sanitized
Attack Surface
1 unprotected

YITH WooCommerce Catalog Mode Attack Surface

Entry Points5
Unprotected1

AJAX Handlers 5

authwp_ajax_yith_plugin_fw_gutenberg_do_shortcodeplugin-fw\includes\builders\gutenberg\class-yith-gutenberg.php:63
authwp_ajax_yith_plugin_fw_save_toggle_element_metaboxplugin-fw\includes\class-yit-metabox.php:86
authwp_ajax_yith_plugin_fw_save_toggle_elementplugin-fw\includes\class-yit-plugin-panel.php:138
authwp_ajax_yith_bh_onboardingplugin-fw\includes\class-yith-bh-onboarding.php:37
authwp_ajax_yith_create_log_fileplugin-fw\includes\class-yith-system-status.php:101
WordPress Hooks 117
filteryith_show_plugin_row_metaclass-yith-woocommerce-catalog-mode.php:76
actionadmin_enqueue_scriptsclass-yith-woocommerce-catalog-mode.php:80
actionadmin_menuclass-yith-woocommerce-catalog-mode.php:81
actioninitclass-yith-woocommerce-catalog-mode.php:85
actionwoocommerce_before_shop_loop_item_titleclass-yith-woocommerce-catalog-mode.php:86
filterwoocommerce_loop_add_to_cart_linkclass-yith-woocommerce-catalog-mode.php:87
filterwoocommerce_add_to_cart_validationclass-yith-woocommerce-catalog-mode.php:88
actionwp_enqueue_scriptsclass-yith-woocommerce-catalog-mode.php:89
filterywctm_css_classesclass-yith-woocommerce-catalog-mode.php:90
filterywctm_css_classesclass-yith-woocommerce-catalog-mode.php:91
filterwoocommerce_loop_add_to_cart_linkclass-yith-woocommerce-catalog-mode.php:94
filterget_pagesclass-yith-woocommerce-catalog-mode.php:361
filterwp_get_nav_menu_itemsclass-yith-woocommerce-catalog-mode.php:362
filterwp_nav_menu_objectsclass-yith-woocommerce-catalog-mode.php:363
actionwpclass-yith-woocommerce-catalog-mode.php:364
filterwoocommerce_loop_add_to_cart_linkclass-yith-woocommerce-catalog-mode.php:524
actionwoocommerce_after_shop_loop_itemclass-yith-woocommerce-catalog-mode.php:529
actionywctm_initinit.php:91
actionadmin_noticesinit.php:102
actionadmin_noticesinit.php:104
actionplugins_loadedinit.php:111
actionbefore_woocommerce_initinit.php:139
actionelementor/elements/categories_registeredplugin-fw\includes\builders\elementor\class-yith-elementor.php:50
actionelementor/editor/after_enqueue_stylesplugin-fw\includes\builders\elementor\class-yith-elementor.php:52
actionelementor/frontend/after_enqueue_stylesplugin-fw\includes\builders\elementor\class-yith-elementor.php:53
actioninitplugin-fw\includes\builders\gutenberg\class-yith-gutenberg.php:60
actioninitplugin-fw\includes\builders\gutenberg\class-yith-gutenberg.php:61
actioninitplugin-fw\includes\builders\gutenberg\class-yith-gutenberg.php:62
actionwc_ajax_yith_plugin_fw_gutenberg_do_shortcodeplugin-fw\includes\builders\gutenberg\class-yith-gutenberg.php:64
actioninitplugin-fw\includes\class-yit-assets.php:47
actionelementor/editor/before_enqueue_stylesplugin-fw\includes\class-yit-assets.php:48
actionadmin_enqueue_scriptsplugin-fw\includes\class-yit-assets.php:50
actioninitplugin-fw\includes\class-yit-assets.php:52
actionshould_load_block_editor_scripts_and_stylesplugin-fw\includes\class-yit-assets.php:53
actionadmin_enqueue_scriptsplugin-fw\includes\class-yit-icons.php:970
actionwp_enqueue_scriptsplugin-fw\includes\class-yit-icons.php:971
actionadd_meta_boxesplugin-fw\includes\class-yit-metabox.php:80
actionsave_postplugin-fw\includes\class-yit-metabox.php:81
actionadmin_enqueue_scriptsplugin-fw\includes\class-yit-metabox.php:82
filteryit_icons_screen_idsplugin-fw\includes\class-yit-metabox.php:84
filteradmin_body_classplugin-fw\includes\class-yit-plugin-panel-woocommerce.php:93
actionadmin_initplugin-fw\includes\class-yit-plugin-panel-woocommerce.php:94
actionadmin_menuplugin-fw\includes\class-yit-plugin-panel-woocommerce.php:95
actionadmin_menuplugin-fw\includes\class-yit-plugin-panel-woocommerce.php:96
actionadmin_bar_menuplugin-fw\includes\class-yit-plugin-panel-woocommerce.php:97
actionadmin_enqueue_scriptsplugin-fw\includes\class-yit-plugin-panel-woocommerce.php:98
actionadmin_initplugin-fw\includes\class-yit-plugin-panel-woocommerce.php:99
filterwoocommerce_screen_idsplugin-fw\includes\class-yit-plugin-panel-woocommerce.php:100
filterwoocommerce_admin_settings_sanitize_optionplugin-fw\includes\class-yit-plugin-panel-woocommerce.php:102
actionyith_plugin_fw_get_field_afterplugin-fw\includes\class-yit-plugin-panel-woocommerce.php:104
actionadmin_action_yith_plugin_fw_save_toggle_elementplugin-fw\includes\class-yit-plugin-panel-woocommerce.php:105
filterwoocommerce_admin_settings_sanitize_optionplugin-fw\includes\class-yit-plugin-panel-woocommerce.php:106
actionadmin_enqueue_scriptsplugin-fw\includes\class-yit-plugin-panel-woocommerce.php:108
actionadmin_initplugin-fw\includes\class-yit-plugin-panel-woocommerce.php:109
filteryith_plugin_fw_premium_landing_uriplugin-fw\includes\class-yit-plugin-panel-woocommerce.php:112
actionwoocommerce_admin_field_boxinfoplugin-fw\includes\class-yit-plugin-panel-woocommerce.php:126
actionwoocommerce_admin_field_yith-fieldplugin-fw\includes\class-yit-plugin-panel-woocommerce.php:127
filterwoocommerce_admin_settings_sanitize_optionplugin-fw\includes\class-yit-plugin-panel-woocommerce.php:129
actionadmin_menuplugin-fw\includes\class-yit-plugin-panel-woocommerce.php:132
filteradd_menu_classesplugin-fw\includes\class-yit-plugin-panel-woocommerce.php:134
filteradmin_body_classplugin-fw\includes\class-yit-plugin-panel.php:121
actionadmin_initplugin-fw\includes\class-yit-plugin-panel.php:122
actionadmin_menuplugin-fw\includes\class-yit-plugin-panel.php:123
actionadmin_menuplugin-fw\includes\class-yit-plugin-panel.php:124
actionadmin_bar_menuplugin-fw\includes\class-yit-plugin-panel.php:125
actionadmin_initplugin-fw\includes\class-yit-plugin-panel.php:126
actionadmin_enqueue_scriptsplugin-fw\includes\class-yit-plugin-panel.php:128
actionadmin_initplugin-fw\includes\class-yit-plugin-panel.php:129
filteryith_plugin_fw_premium_landing_uriplugin-fw\includes\class-yit-plugin-panel.php:132
actionadmin_enqueue_scriptsplugin-fw\includes\class-yit-plugin-panel.php:137
actionall_admin_noticesplugin-fw\includes\class-yit-plugin-panel.php:242
actionadmin_footerplugin-fw\includes\class-yit-plugin-panel.php:243
filterparent_fileplugin-fw\includes\class-yit-plugin-panel.php:245
filtersubmenu_fileplugin-fw\includes\class-yit-plugin-panel.php:246
actionadmin_menuplugin-fw\includes\class-yit-plugin-panel.php:259
filteradd_menu_classesplugin-fw\includes\class-yit-plugin-panel.php:260
filterremovable_query_argsplugin-fw\includes\class-yit-plugin-panel.php:261
actionadmin_enqueue_scriptsplugin-fw\includes\class-yit-plugin-panel.php:1081
actionadmin_initplugin-fw\includes\class-yit-plugin-panel.php:1082
actionadmin_footerplugin-fw\includes\class-yit-plugin-panel.php:1213
actionadmin_initplugin-fw\includes\class-yit-plugin-subpanel.php:44
actionadmin_menuplugin-fw\includes\class-yit-plugin-subpanel.php:45
actionadmin_bar_menuplugin-fw\includes\class-yit-plugin-subpanel.php:46
actionadmin_initplugin-fw\includes\class-yit-plugin-subpanel.php:47
actionadmin_enqueue_scriptsplugin-fw\includes\class-yit-plugin-subpanel.php:48
actionadmin_enqueue_scriptsplugin-fw\includes\class-yit-pointers.php:118
actionadmin_initplugin-fw\includes\class-yit-pointers.php:119
actionyith_bh_onboardingplugin-fw\includes\class-yith-bh-onboarding.php:36
actionwp_dashboard_setupplugin-fw\includes\class-yith-dashboard.php:146
actionadmin_enqueue_scriptsplugin-fw\includes\class-yith-dashboard.php:147
actionadmin_initplugin-fw\includes\class-yith-post-type-admin.php:65
actioncurrent_screenplugin-fw\includes\class-yith-post-type-admin.php:67
actionedit_form_topplugin-fw\includes\class-yith-post-type-admin.php:70
actionmanage_posts_extra_tablenavplugin-fw\includes\class-yith-post-type-admin.php:119
actionmanage_posts_extra_tablenavplugin-fw\includes\class-yith-post-type-admin.php:120
actionrestrict_manage_postsplugin-fw\includes\class-yith-post-type-admin.php:122
filterrequestplugin-fw\includes\class-yith-post-type-admin.php:123
filterlist_table_primary_columnplugin-fw\includes\class-yith-post-type-admin.php:125
filterpost_row_actionsplugin-fw\includes\class-yith-post-type-admin.php:126
filterpage_row_actionsplugin-fw\includes\class-yith-post-type-admin.php:127
filterdefault_hidden_columnsplugin-fw\includes\class-yith-post-type-admin.php:129
actiondisable_months_dropdownplugin-fw\includes\class-yith-post-type-admin.php:137
filteradmin_body_classplugin-fw\includes\class-yith-system-status.php:95
actionadmin_menuplugin-fw\includes\class-yith-system-status.php:96
actionadmin_initplugin-fw\includes\class-yith-system-status.php:97
actionadmin_noticesplugin-fw\includes\class-yith-system-status.php:98
actionadmin_enqueue_scriptsplugin-fw\includes\class-yith-system-status.php:99
actioninitplugin-fw\includes\class-yith-system-status.php:100
filteryith_plugin_fw_privacy_guide_contentplugin-fw\includes\privacy\class-yith-privacy-plugin-abstract.php:39
actionadmin_initplugin-fw\includes\privacy\class-yith-privacy.php:50
actionplugins_loadedplugin-fw\init.php:94
filterextra_theme_headersplugin-fw\yit-functions.php:602
filteryit_title_special_charactersplugin-fw\yit-functions.php:726
filterplugin_row_metaplugin-fw\yit-plugin.php:56
actionadmin_noticesplugin-fw\yit-plugin.php:298
actionplugins_loadedplugin-fw\yit-plugin.php:300
actionshutdownplugin-fw\yit-woocommerce-compatibility.php:765
Maintenance & Trust

YITH WooCommerce Catalog Mode Maintenance & Trust

Maintenance Signals

WordPress version tested6.9.4
Last updatedFeb 26, 2026
PHP min version7.4
Downloads2.4M

Community Trust

Rating72/100
Number of ratings43
Active installs60K
Developer Profile

YITH WooCommerce Catalog Mode Developer Profile

YITHEMES

33 plugins · 1.1M total installs

77
trust score
Avg Security Score
97/100
Avg Patch Time
411 days
View full developer profile
Detection Fingerprints

How We Detect YITH WooCommerce Catalog Mode

Patterns used to identify this plugin on WordPress sites during automated security audits and web crawling.

Asset Fingerprints

Asset Paths
/wp-content/plugins/yith-woocommerce-catalog-mode/assets/css/admin.css/wp-content/plugins/yith-woocommerce-catalog-mode/assets/css/frontend.css/wp-content/plugins/yith-woocommerce-catalog-mode/assets/js/admin.js
Version Parameters
yith-woocommerce-catalog-mode/assets/css/admin.css?ver=yith-woocommerce-catalog-mode/assets/css/frontend.css?ver=yith-woocommerce-catalog-mode/assets/js/admin.js?ver=

HTML / DOM Fingerprints

CSS Classes
ywctm-catalog-mode-container
Data Attributes
data-ywctm-product-id
JS Globals
ywctm_frontend_params
FAQ

Frequently Asked Questions about YITH WooCommerce Catalog Mode