YITH WooCommerce Order & Shipment Tracking Security & Risk Analysis

wordpress.org/plugins/yith-woocommerce-order-tracking

Add an easy tool to manage order shipping information of your shop and to notified your customers about the shipping.

7K active installs v2.44.0 PHP 7.4+ WP 6.7+ Updated Feb 26, 2026
carrierdeliveryshippingtrackingwoocommerce
99
A · Safe
CVEs total1
Unpatched0
Last CVENov 11, 2022
Safety Verdict

Is YITH WooCommerce Order & Shipment Tracking Safe to Use in 2026?

Generally Safe

Score 99/100

YITH WooCommerce Order & Shipment Tracking has a strong security track record. Known vulnerabilities have been patched promptly.

1 known CVELast CVE: Nov 11, 2022Updated 1mo ago
Risk Assessment

The "yith-woocommerce-order-tracking" plugin, version 2.44.0, exhibits a generally good security posture, with strong adherence to secure coding practices like prepared statements for SQL queries and a high percentage of properly escaped output. The absence of dangerous functions, file operations, and critical/high severity taint flows further indicates a solid foundation. However, the presence of one AJAX handler without authentication checks presents a direct attack vector that could potentially be exploited to perform unauthorized actions. While there are no currently unpatched vulnerabilities, the plugin has a history of one high severity CVE, suggesting that past security issues have been addressed, but it's important to remain vigilant for potential future vulnerabilities. The overall risk is moderate, with the primary concern being the unprotected AJAX endpoint.

Key Concerns

  • Unprotected AJAX handler
  • Past high severity CVE
Vulnerabilities
1

YITH WooCommerce Order & Shipment Tracking Security Vulnerabilities

CVEs by Year

1 CVE in 2022
2022
Patched Has unpatched

Severity Breakdown

High
1

1 total CVE

YITH plugins by YITHEMES <= (Various Versions) - Missing Authorization

Nov 11, 2022 Patched in 2.8.0 (438d)
Code Analysis
Analyzed Mar 16, 2026

YITH WooCommerce Order & Shipment Tracking Code Analysis

Dangerous Functions
0
Raw SQL Queries
0
5 prepared
Unescaped Output
89
1491 escaped
Nonce Checks
15
Capability Checks
16
File Operations
0
External Requests
7
Bundled Libraries
1

Bundled Libraries

Select2

SQL Query Safety

100% prepared5 total queries

Output Escaping

94% escaped1580 total outputs
Data Flows
All sanitized

Data Flow Analysis

13 flows
do_shortcode (plugin-fw\includes\builders\gutenberg\class-yith-gutenberg.php:279)
Source (user input) Sink (dangerous op) Sanitizer Transform Unsanitized Sanitized
Attack Surface
1 unprotected

YITH WooCommerce Order & Shipment Tracking Attack Surface

Entry Points5
Unprotected1

AJAX Handlers 5

authwp_ajax_yith_plugin_fw_gutenberg_do_shortcodeplugin-fw\includes\builders\gutenberg\class-yith-gutenberg.php:63
authwp_ajax_yith_plugin_fw_save_toggle_element_metaboxplugin-fw\includes\class-yit-metabox.php:86
authwp_ajax_yith_plugin_fw_save_toggle_elementplugin-fw\includes\class-yit-plugin-panel.php:138
authwp_ajax_yith_bh_onboardingplugin-fw\includes\class-yith-bh-onboarding.php:37
authwp_ajax_yith_create_log_fileplugin-fw\includes\class-yith-system-status.php:101
WordPress Hooks 113
actionadmin_menuincludes\class.yith-woocommerce-order-tracking.php:109
filteryith_show_plugin_row_metaincludes\class.yith-woocommerce-order-tracking.php:111
actionyith_order_tracking_premiumincludes\class.yith-woocommerce-order-tracking.php:113
actionwp_enqueue_scriptsincludes\class.yith-woocommerce-order-tracking.php:120
actionadmin_enqueue_scriptsincludes\class.yith-woocommerce-order-tracking.php:121
actionadd_meta_boxesincludes\class.yith-woocommerce-order-tracking.php:126
actionwoocommerce_checkout_order_processedincludes\class.yith-woocommerce-order-tracking.php:131
actionmanage_woocommerce_page_wc-orders_custom_columnincludes\class.yith-woocommerce-order-tracking.php:136
actionmanage_shop_order_posts_custom_columnincludes\class.yith-woocommerce-order-tracking.php:137
actionwoocommerce_process_shop_order_metaincludes\class.yith-woocommerce-order-tracking.php:142
actionwoocommerce_my_account_my_orders_actionsincludes\class.yith-woocommerce-order-tracking.php:152
actionbefore_woocommerce_initincludes\class.yith-woocommerce-order-tracking.php:157
actionwoocommerce_order_details_after_order_table_itemsincludes\class.yith-woocommerce-order-tracking.php:873
actionwoocommerce_order_details_after_order_tableincludes\class.yith-woocommerce-order-tracking.php:875
actionadmin_noticesinit.php:80
actionadmin_noticesinit.php:82
actionplugins_loadedinit.php:89
actionyith_ywot_initinit.php:144
actionelementor/elements/categories_registeredplugin-fw\includes\builders\elementor\class-yith-elementor.php:50
actionelementor/editor/after_enqueue_stylesplugin-fw\includes\builders\elementor\class-yith-elementor.php:52
actionelementor/frontend/after_enqueue_stylesplugin-fw\includes\builders\elementor\class-yith-elementor.php:53
actioninitplugin-fw\includes\builders\gutenberg\class-yith-gutenberg.php:60
actioninitplugin-fw\includes\builders\gutenberg\class-yith-gutenberg.php:61
actioninitplugin-fw\includes\builders\gutenberg\class-yith-gutenberg.php:62
actionwc_ajax_yith_plugin_fw_gutenberg_do_shortcodeplugin-fw\includes\builders\gutenberg\class-yith-gutenberg.php:64
actioninitplugin-fw\includes\class-yit-assets.php:47
actionelementor/editor/before_enqueue_stylesplugin-fw\includes\class-yit-assets.php:48
actionadmin_enqueue_scriptsplugin-fw\includes\class-yit-assets.php:50
actioninitplugin-fw\includes\class-yit-assets.php:52
actionshould_load_block_editor_scripts_and_stylesplugin-fw\includes\class-yit-assets.php:53
actionadmin_enqueue_scriptsplugin-fw\includes\class-yit-icons.php:970
actionwp_enqueue_scriptsplugin-fw\includes\class-yit-icons.php:971
actionadd_meta_boxesplugin-fw\includes\class-yit-metabox.php:80
actionsave_postplugin-fw\includes\class-yit-metabox.php:81
actionadmin_enqueue_scriptsplugin-fw\includes\class-yit-metabox.php:82
filteryit_icons_screen_idsplugin-fw\includes\class-yit-metabox.php:84
filteradmin_body_classplugin-fw\includes\class-yit-plugin-panel-woocommerce.php:93
actionadmin_initplugin-fw\includes\class-yit-plugin-panel-woocommerce.php:94
actionadmin_menuplugin-fw\includes\class-yit-plugin-panel-woocommerce.php:95
actionadmin_menuplugin-fw\includes\class-yit-plugin-panel-woocommerce.php:96
actionadmin_bar_menuplugin-fw\includes\class-yit-plugin-panel-woocommerce.php:97
actionadmin_enqueue_scriptsplugin-fw\includes\class-yit-plugin-panel-woocommerce.php:98
actionadmin_initplugin-fw\includes\class-yit-plugin-panel-woocommerce.php:99
filterwoocommerce_screen_idsplugin-fw\includes\class-yit-plugin-panel-woocommerce.php:100
filterwoocommerce_admin_settings_sanitize_optionplugin-fw\includes\class-yit-plugin-panel-woocommerce.php:102
actionyith_plugin_fw_get_field_afterplugin-fw\includes\class-yit-plugin-panel-woocommerce.php:104
actionadmin_action_yith_plugin_fw_save_toggle_elementplugin-fw\includes\class-yit-plugin-panel-woocommerce.php:105
filterwoocommerce_admin_settings_sanitize_optionplugin-fw\includes\class-yit-plugin-panel-woocommerce.php:106
actionadmin_enqueue_scriptsplugin-fw\includes\class-yit-plugin-panel-woocommerce.php:108
actionadmin_initplugin-fw\includes\class-yit-plugin-panel-woocommerce.php:109
filteryith_plugin_fw_premium_landing_uriplugin-fw\includes\class-yit-plugin-panel-woocommerce.php:112
actionwoocommerce_admin_field_boxinfoplugin-fw\includes\class-yit-plugin-panel-woocommerce.php:126
actionwoocommerce_admin_field_yith-fieldplugin-fw\includes\class-yit-plugin-panel-woocommerce.php:127
filterwoocommerce_admin_settings_sanitize_optionplugin-fw\includes\class-yit-plugin-panel-woocommerce.php:129
actionadmin_menuplugin-fw\includes\class-yit-plugin-panel-woocommerce.php:132
filteradd_menu_classesplugin-fw\includes\class-yit-plugin-panel-woocommerce.php:134
filteradmin_body_classplugin-fw\includes\class-yit-plugin-panel.php:121
actionadmin_initplugin-fw\includes\class-yit-plugin-panel.php:122
actionadmin_menuplugin-fw\includes\class-yit-plugin-panel.php:123
actionadmin_menuplugin-fw\includes\class-yit-plugin-panel.php:124
actionadmin_bar_menuplugin-fw\includes\class-yit-plugin-panel.php:125
actionadmin_initplugin-fw\includes\class-yit-plugin-panel.php:126
actionadmin_enqueue_scriptsplugin-fw\includes\class-yit-plugin-panel.php:128
actionadmin_initplugin-fw\includes\class-yit-plugin-panel.php:129
filteryith_plugin_fw_premium_landing_uriplugin-fw\includes\class-yit-plugin-panel.php:132
actionadmin_enqueue_scriptsplugin-fw\includes\class-yit-plugin-panel.php:137
actionall_admin_noticesplugin-fw\includes\class-yit-plugin-panel.php:242
actionadmin_footerplugin-fw\includes\class-yit-plugin-panel.php:243
filterparent_fileplugin-fw\includes\class-yit-plugin-panel.php:245
filtersubmenu_fileplugin-fw\includes\class-yit-plugin-panel.php:246
actionadmin_menuplugin-fw\includes\class-yit-plugin-panel.php:259
filteradd_menu_classesplugin-fw\includes\class-yit-plugin-panel.php:260
filterremovable_query_argsplugin-fw\includes\class-yit-plugin-panel.php:261
actionadmin_enqueue_scriptsplugin-fw\includes\class-yit-plugin-panel.php:1081
actionadmin_initplugin-fw\includes\class-yit-plugin-panel.php:1082
actionadmin_footerplugin-fw\includes\class-yit-plugin-panel.php:1213
actionadmin_initplugin-fw\includes\class-yit-plugin-subpanel.php:44
actionadmin_menuplugin-fw\includes\class-yit-plugin-subpanel.php:45
actionadmin_bar_menuplugin-fw\includes\class-yit-plugin-subpanel.php:46
actionadmin_initplugin-fw\includes\class-yit-plugin-subpanel.php:47
actionadmin_enqueue_scriptsplugin-fw\includes\class-yit-plugin-subpanel.php:48
actionadmin_enqueue_scriptsplugin-fw\includes\class-yit-pointers.php:118
actionadmin_initplugin-fw\includes\class-yit-pointers.php:119
actionyith_bh_onboardingplugin-fw\includes\class-yith-bh-onboarding.php:36
actionwp_dashboard_setupplugin-fw\includes\class-yith-dashboard.php:146
actionadmin_enqueue_scriptsplugin-fw\includes\class-yith-dashboard.php:147
actionadmin_initplugin-fw\includes\class-yith-post-type-admin.php:65
actioncurrent_screenplugin-fw\includes\class-yith-post-type-admin.php:67
actionedit_form_topplugin-fw\includes\class-yith-post-type-admin.php:70
actionmanage_posts_extra_tablenavplugin-fw\includes\class-yith-post-type-admin.php:119
actionmanage_posts_extra_tablenavplugin-fw\includes\class-yith-post-type-admin.php:120
actionrestrict_manage_postsplugin-fw\includes\class-yith-post-type-admin.php:122
filterrequestplugin-fw\includes\class-yith-post-type-admin.php:123
filterlist_table_primary_columnplugin-fw\includes\class-yith-post-type-admin.php:125
filterpost_row_actionsplugin-fw\includes\class-yith-post-type-admin.php:126
filterpage_row_actionsplugin-fw\includes\class-yith-post-type-admin.php:127
filterdefault_hidden_columnsplugin-fw\includes\class-yith-post-type-admin.php:129
actiondisable_months_dropdownplugin-fw\includes\class-yith-post-type-admin.php:137
filteradmin_body_classplugin-fw\includes\class-yith-system-status.php:95
actionadmin_menuplugin-fw\includes\class-yith-system-status.php:96
actionadmin_initplugin-fw\includes\class-yith-system-status.php:97
actionadmin_noticesplugin-fw\includes\class-yith-system-status.php:98
actionadmin_enqueue_scriptsplugin-fw\includes\class-yith-system-status.php:99
actioninitplugin-fw\includes\class-yith-system-status.php:100
filteryith_plugin_fw_privacy_guide_contentplugin-fw\includes\privacy\class-yith-privacy-plugin-abstract.php:39
actionadmin_initplugin-fw\includes\privacy\class-yith-privacy.php:50
actionplugins_loadedplugin-fw\init.php:94
filterextra_theme_headersplugin-fw\yit-functions.php:602
filteryit_title_special_charactersplugin-fw\yit-functions.php:726
filterplugin_row_metaplugin-fw\yit-plugin.php:56
actionadmin_noticesplugin-fw\yit-plugin.php:298
actionplugins_loadedplugin-fw\yit-plugin.php:300
actionshutdownplugin-fw\yit-woocommerce-compatibility.php:765
Maintenance & Trust

YITH WooCommerce Order & Shipment Tracking Maintenance & Trust

Maintenance Signals

WordPress version tested6.9.4
Last updatedFeb 26, 2026
PHP min version7.4
Downloads624K

Community Trust

Rating74/100
Number of ratings15
Active installs7K
Developer Profile

YITH WooCommerce Order & Shipment Tracking Developer Profile

YITHEMES

33 plugins · 1.1M total installs

77
trust score
Avg Security Score
97/100
Avg Patch Time
411 days
View full developer profile
Detection Fingerprints

How We Detect YITH WooCommerce Order & Shipment Tracking

Patterns used to identify this plugin on WordPress sites during automated security audits and web crawling.

Asset Fingerprints

Asset Paths
/wp-content/plugins/yith-woocommerce-order-tracking/assets/css/ywot-admin.css/wp-content/plugins/yith-woocommerce-order-tracking/assets/css/ywot-frontend.css/wp-content/plugins/yith-woocommerce-order-tracking/assets/js/ywot-admin.js/wp-content/plugins/yith-woocommerce-order-tracking/assets/js/ywot-frontend.js
Script Paths
/wp-content/plugins/yith-woocommerce-order-tracking/assets/js/ywot-admin.js/wp-content/plugins/yith-woocommerce-order-tracking/assets/js/ywot-frontend.js
Version Parameters
/wp-content/plugins/yith-woocommerce-order-tracking/assets/css/ywot-admin.css?ver=/wp-content/plugins/yith-woocommerce-order-tracking/assets/css/ywot-frontend.css?ver=/wp-content/plugins/yith-woocommerce-order-tracking/assets/js/ywot-admin.js?ver=/wp-content/plugins/yith-woocommerce-order-tracking/assets/js/ywot-frontend.js?ver=

HTML / DOM Fingerprints

CSS Classes
yith-ywot-admin-settingsyith-ywot-tracking-code-fieldyith-ywot-carrier-fieldyith-ywot-tracking-info-wrapperywot-order-tracking-details
HTML Comments
<!-- YITH WooCommerce Order Tracking plugin --><!-- Order Tracking Info -->
Data Attributes
data-ywot-tracking-codedata-ywot-carrier
JS Globals
window.ywot_admin_paramswindow.ywot_frontend_params
FAQ

Frequently Asked Questions about YITH WooCommerce Order & Shipment Tracking