WP-Safety

YITH Frequently Bought Together for WooCommerce Security & Risk Analysis

wordpress.org/plugins/yith-woocommerce-frequently-bought-together

The YITH WooCommerce Frequently Bought Together plugin lets you add product suggestions with a simple summary in each product page.

9K active installs v1.55.0 PHP 7.4+ WP 6.7+ Updated Mar 3, 2026
bought-togetherbundlesfrequently-bought-productsfrequently-bought-togetheryith
99
A · Safe
CVEs total1
Unpatched0
Last CVENov 11, 2022
Plugin page Download
Safety Verdict

Is YITH Frequently Bought Together for WooCommerce Safe to Use in 2026?

Generally Safe

Score 99/100

YITH Frequently Bought Together for WooCommerce has a strong security track record. Known vulnerabilities have been patched promptly.

1 known CVELast CVE: Nov 11, 2022Updated 1mo ago
Risk Assessment

The "yith-woocommerce-frequently-bought-together" plugin v1.55.0 exhibits a generally good security posture, with strong adherence to secure coding practices such as the use of prepared statements for all SQL queries and a high percentage of properly escaped output. The absence of critical or high severity taint analysis findings and no raw SQL queries further bolster this assessment. The plugin also demonstrates robust use of nonces and capability checks, indicating an effort to protect its entry points. However, a notable concern is the presence of one AJAX handler without authentication checks, which represents a potential entry point for unauthorized actions if exploited.

Key Concerns

  • AJAX handler without authentication
  • One High severity CVE historically
Vulnerabilities
1

YITH Frequently Bought Together for WooCommerce Security Vulnerabilities

CVEs by Year

1 CVE in 2022
2022
Patched Has unpatched

Severity Breakdown

High
1

1 total CVE

WF-b948574a-0aab-4596-83e6-04be21f78bc1-yith-woocommerce-frequently-bought-togetherhigh · 7.1Missing Authorization

YITH plugins by YITHEMES <= (Various Versions) - Missing Authorization

Nov 11, 2022 Patched in 1.19.1 (438d)
Code Analysis
Analyzed Mar 16, 2026

YITH Frequently Bought Together for WooCommerce Code Analysis

Dangerous Functions
0
Raw SQL Queries
0
5 prepared
Unescaped Output
104
1547 escaped
Nonce Checks
17
Capability Checks
16
File Operations
0
External Requests
7
Bundled Libraries
1

Bundled Libraries

Select2

SQL Query Safety

100% prepared5 total queries

Output Escaping

94% escaped1651 total outputs
Data Flows
All sanitized

Data Flow Analysis

13 flows
do_shortcode (plugin-fw\includes\builders\gutenberg\class-yith-gutenberg.php:279)
Source (user input) Sink (dangerous op) Sanitizer Transform Unsanitized Sanitized
Attack Surface
1 unprotected

YITH Frequently Bought Together for WooCommerce Attack Surface

Entry Points8
Unprotected1

AJAX Handlers 7

authwp_ajax_yith_ajax_search_productincludes\class.yith-wfbt-admin.php:121
noprivwp_ajax_yith_ajax_search_productincludes\class.yith-wfbt-admin.php:122
authwp_ajax_yith_plugin_fw_gutenberg_do_shortcodeplugin-fw\includes\builders\gutenberg\class-yith-gutenberg.php:63
authwp_ajax_yith_plugin_fw_save_toggle_element_metaboxplugin-fw\includes\class-yit-metabox.php:86
authwp_ajax_yith_plugin_fw_save_toggle_elementplugin-fw\includes\class-yit-plugin-panel.php:138
authwp_ajax_yith_bh_onboardingplugin-fw\includes\class-yith-bh-onboarding.php:37
authwp_ajax_yith_create_log_fileplugin-fw\includes\class-yith-system-status.php:101

Shortcodes 1

[ywfbt_form] includes\class.yith-wfbt-frontend.php:65
WordPress Hooks 111
actionadmin_menuincludes\class.yith-wfbt-admin.php:107
filteryith_show_plugin_row_metaincludes\class.yith-wfbt-admin.php:111
actionyith_wfbt_premiumincludes\class.yith-wfbt-admin.php:114
filterwoocommerce_product_data_tabsincludes\class.yith-wfbt-admin.php:117
actionwoocommerce_product_data_panelsincludes\class.yith-wfbt-admin.php:118
actionwp_enqueue_scriptsincludes\class.yith-wfbt-frontend.php:61
actionplugins_loadedincludes\class.yith-wfbt-frontend.php:63
filterrender_block_woocommerce/product-detailsincludes\class.yith-wfbt-frontend.php:212
actionwoocommerce_after_single_product_summaryincludes\class.yith-wfbt-frontend.php:215
actionbefore_woocommerce_initincludes\class.yith-wfbt.php:69
actionwp_loadedincludes\class.yith-wfbt.php:84
actioninitincludes\class.yith-wfbt.php:86
actionyith_wfbt_free_initinit.php:148
actionadmin_noticesinit.php:159
actionadmin_noticesinit.php:161
actionplugins_loadedinit.php:168
actionelementor/elements/categories_registeredplugin-fw\includes\builders\elementor\class-yith-elementor.php:50
actionelementor/editor/after_enqueue_stylesplugin-fw\includes\builders\elementor\class-yith-elementor.php:52
actionelementor/frontend/after_enqueue_stylesplugin-fw\includes\builders\elementor\class-yith-elementor.php:53
actioninitplugin-fw\includes\builders\gutenberg\class-yith-gutenberg.php:60
actioninitplugin-fw\includes\builders\gutenberg\class-yith-gutenberg.php:61
actioninitplugin-fw\includes\builders\gutenberg\class-yith-gutenberg.php:62
actionwc_ajax_yith_plugin_fw_gutenberg_do_shortcodeplugin-fw\includes\builders\gutenberg\class-yith-gutenberg.php:64
actioninitplugin-fw\includes\class-yit-assets.php:47
actionelementor/editor/before_enqueue_stylesplugin-fw\includes\class-yit-assets.php:48
actionadmin_enqueue_scriptsplugin-fw\includes\class-yit-assets.php:50
actioninitplugin-fw\includes\class-yit-assets.php:52
actionshould_load_block_editor_scripts_and_stylesplugin-fw\includes\class-yit-assets.php:53
actionadmin_enqueue_scriptsplugin-fw\includes\class-yit-icons.php:970
actionwp_enqueue_scriptsplugin-fw\includes\class-yit-icons.php:971
actionadd_meta_boxesplugin-fw\includes\class-yit-metabox.php:80
actionsave_postplugin-fw\includes\class-yit-metabox.php:81
actionadmin_enqueue_scriptsplugin-fw\includes\class-yit-metabox.php:82
filteryit_icons_screen_idsplugin-fw\includes\class-yit-metabox.php:84
filteradmin_body_classplugin-fw\includes\class-yit-plugin-panel-woocommerce.php:93
actionadmin_initplugin-fw\includes\class-yit-plugin-panel-woocommerce.php:94
actionadmin_menuplugin-fw\includes\class-yit-plugin-panel-woocommerce.php:95
actionadmin_menuplugin-fw\includes\class-yit-plugin-panel-woocommerce.php:96
actionadmin_bar_menuplugin-fw\includes\class-yit-plugin-panel-woocommerce.php:97
actionadmin_enqueue_scriptsplugin-fw\includes\class-yit-plugin-panel-woocommerce.php:98
actionadmin_initplugin-fw\includes\class-yit-plugin-panel-woocommerce.php:99
filterwoocommerce_screen_idsplugin-fw\includes\class-yit-plugin-panel-woocommerce.php:100
filterwoocommerce_admin_settings_sanitize_optionplugin-fw\includes\class-yit-plugin-panel-woocommerce.php:102
actionyith_plugin_fw_get_field_afterplugin-fw\includes\class-yit-plugin-panel-woocommerce.php:104
actionadmin_action_yith_plugin_fw_save_toggle_elementplugin-fw\includes\class-yit-plugin-panel-woocommerce.php:105
filterwoocommerce_admin_settings_sanitize_optionplugin-fw\includes\class-yit-plugin-panel-woocommerce.php:106
actionadmin_enqueue_scriptsplugin-fw\includes\class-yit-plugin-panel-woocommerce.php:108
actionadmin_initplugin-fw\includes\class-yit-plugin-panel-woocommerce.php:109
filteryith_plugin_fw_premium_landing_uriplugin-fw\includes\class-yit-plugin-panel-woocommerce.php:112
actionwoocommerce_admin_field_boxinfoplugin-fw\includes\class-yit-plugin-panel-woocommerce.php:126
actionwoocommerce_admin_field_yith-fieldplugin-fw\includes\class-yit-plugin-panel-woocommerce.php:127
filterwoocommerce_admin_settings_sanitize_optionplugin-fw\includes\class-yit-plugin-panel-woocommerce.php:129
actionadmin_menuplugin-fw\includes\class-yit-plugin-panel-woocommerce.php:132
filteradd_menu_classesplugin-fw\includes\class-yit-plugin-panel-woocommerce.php:134
filteradmin_body_classplugin-fw\includes\class-yit-plugin-panel.php:121
actionadmin_initplugin-fw\includes\class-yit-plugin-panel.php:122
actionadmin_menuplugin-fw\includes\class-yit-plugin-panel.php:123
actionadmin_menuplugin-fw\includes\class-yit-plugin-panel.php:124
actionadmin_bar_menuplugin-fw\includes\class-yit-plugin-panel.php:125
actionadmin_initplugin-fw\includes\class-yit-plugin-panel.php:126
actionadmin_enqueue_scriptsplugin-fw\includes\class-yit-plugin-panel.php:128
actionadmin_initplugin-fw\includes\class-yit-plugin-panel.php:129
filteryith_plugin_fw_premium_landing_uriplugin-fw\includes\class-yit-plugin-panel.php:132
actionadmin_enqueue_scriptsplugin-fw\includes\class-yit-plugin-panel.php:137
actionall_admin_noticesplugin-fw\includes\class-yit-plugin-panel.php:242
actionadmin_footerplugin-fw\includes\class-yit-plugin-panel.php:243
filterparent_fileplugin-fw\includes\class-yit-plugin-panel.php:245
filtersubmenu_fileplugin-fw\includes\class-yit-plugin-panel.php:246
actionadmin_menuplugin-fw\includes\class-yit-plugin-panel.php:259
filteradd_menu_classesplugin-fw\includes\class-yit-plugin-panel.php:260
filterremovable_query_argsplugin-fw\includes\class-yit-plugin-panel.php:261
actionadmin_enqueue_scriptsplugin-fw\includes\class-yit-plugin-panel.php:1081
actionadmin_initplugin-fw\includes\class-yit-plugin-panel.php:1082
actionadmin_footerplugin-fw\includes\class-yit-plugin-panel.php:1213
actionadmin_initplugin-fw\includes\class-yit-plugin-subpanel.php:44
actionadmin_menuplugin-fw\includes\class-yit-plugin-subpanel.php:45
actionadmin_bar_menuplugin-fw\includes\class-yit-plugin-subpanel.php:46
actionadmin_initplugin-fw\includes\class-yit-plugin-subpanel.php:47
actionadmin_enqueue_scriptsplugin-fw\includes\class-yit-plugin-subpanel.php:48
actionadmin_enqueue_scriptsplugin-fw\includes\class-yit-pointers.php:118
actionadmin_initplugin-fw\includes\class-yit-pointers.php:119
actionyith_bh_onboardingplugin-fw\includes\class-yith-bh-onboarding.php:36
actionwp_dashboard_setupplugin-fw\includes\class-yith-dashboard.php:146
actionadmin_enqueue_scriptsplugin-fw\includes\class-yith-dashboard.php:147
actionadmin_initplugin-fw\includes\class-yith-post-type-admin.php:65
actioncurrent_screenplugin-fw\includes\class-yith-post-type-admin.php:67
actionedit_form_topplugin-fw\includes\class-yith-post-type-admin.php:70
actionmanage_posts_extra_tablenavplugin-fw\includes\class-yith-post-type-admin.php:119
actionmanage_posts_extra_tablenavplugin-fw\includes\class-yith-post-type-admin.php:120
actionrestrict_manage_postsplugin-fw\includes\class-yith-post-type-admin.php:122
filterrequestplugin-fw\includes\class-yith-post-type-admin.php:123
filterlist_table_primary_columnplugin-fw\includes\class-yith-post-type-admin.php:125
filterpost_row_actionsplugin-fw\includes\class-yith-post-type-admin.php:126
filterpage_row_actionsplugin-fw\includes\class-yith-post-type-admin.php:127
filterdefault_hidden_columnsplugin-fw\includes\class-yith-post-type-admin.php:129
actiondisable_months_dropdownplugin-fw\includes\class-yith-post-type-admin.php:137
filteradmin_body_classplugin-fw\includes\class-yith-system-status.php:95
actionadmin_menuplugin-fw\includes\class-yith-system-status.php:96
actionadmin_initplugin-fw\includes\class-yith-system-status.php:97
actionadmin_noticesplugin-fw\includes\class-yith-system-status.php:98
actionadmin_enqueue_scriptsplugin-fw\includes\class-yith-system-status.php:99
actioninitplugin-fw\includes\class-yith-system-status.php:100
filteryith_plugin_fw_privacy_guide_contentplugin-fw\includes\privacy\class-yith-privacy-plugin-abstract.php:39
actionadmin_initplugin-fw\includes\privacy\class-yith-privacy.php:50
actionplugins_loadedplugin-fw\init.php:94
filterextra_theme_headersplugin-fw\yit-functions.php:602
filteryit_title_special_charactersplugin-fw\yit-functions.php:726
filterplugin_row_metaplugin-fw\yit-plugin.php:56
actionadmin_noticesplugin-fw\yit-plugin.php:298
actionplugins_loadedplugin-fw\yit-plugin.php:300
actionshutdownplugin-fw\yit-woocommerce-compatibility.php:765
Maintenance & Trust

YITH Frequently Bought Together for WooCommerce Maintenance & Trust

Maintenance Signals

WordPress version tested6.9.4
Last updatedMar 3, 2026
PHP min version7.4
Downloads405K

Community Trust

Rating62/100
Number of ratings12
Active installs9K
Alternatives

YITH Frequently Bought Together for WooCommerce Alternatives

Appsell for WooCommerce: Upsell, Cross Sell, Frequently Bought Together, Discounts, Coupons & Bundles

Appsell for WooCommerce: Upsell, Cross Sell, Frequently Bought Together, Discounts, Coupons & Bundles

appsell

A
100

Increase your store's average order value, conversion rate, sales, and revenues significantly with the easiest-to-use Upsell & Cross-sell builder app.

10 No CVEs
PiWeb Products Frequently Bought Together for WooCommerce

PiWeb Products Frequently Bought Together for WooCommerce

products-frequently-bought-together-for-woocommerce

A
100

Product frequently bought together plugin for WooCommerce helps you to increase your sales by showing frequently bought together products.

0 No CVEs
Upsell Funnel Builder for WooCommerce – Create Upsells, Cross-Sells, Order Bumps, Frequently Bought, and Popups.

Upsell Funnel Builder for WooCommerce – Create Upsells, Cross-Sells, Order Bumps, Frequently Bought, and Popups.

upsell-order-bump-offer-for-woocommerce

A
98

Upsell Funnel Builder lets you create WooCommerce Upsells, Order Bumps, One Click upsell, Cross-Sells, Frequently Bought, and Popups.

3K 2 CVEs
WowRevenue – Product Bundles & Bulk Discounts

WowRevenue – Product Bundles & Bulk Discounts

revenue

A
96

WowRevenue is a combination of product bundles and discount campaigns, including bulk discounts, buy x get y discounts, and more.

1K 2 CVEs
Frequently Bought Together Product For Woocommerce

Frequently Bought Together Product For Woocommerce

frequently-bought-together-product-for-woocommerce

A
100

Frequently Bought Together Product For Woocommerce using for puchase more one one product with heavy discount in woocommmerce to make ideal for boost &hellip;

50 No CVEs
Developer Profile

YITH Frequently Bought Together for WooCommerce Developer Profile

YITHEMES

33 plugins · 1.1M total installs

77
trust score
Avg Security Score
97/100
Avg Patch Time
411 days
View full developer profile
Detection Fingerprints

How We Detect YITH Frequently Bought Together for WooCommerce

Patterns used to identify this plugin on WordPress sites during automated security audits and web crawling.

Asset Fingerprints

Asset Paths
/wp-content/plugins/yith-woocommerce-frequently-bought-together/assets/css/yith-wfbt.css
Version Parameters
yith-woocommerce-frequently-bought-together/assets/css/yith-wfbt.css?ver=1.55.0

HTML / DOM Fingerprints

CSS Classes
yith-wfbt-submit-blockyith-wfbt-submit-button
Data Attributes
data-product_id
Shortcode Output
[ywfbt_form
FAQ

Frequently Asked Questions about YITH Frequently Bought Together for WooCommerce