Yikesinc develops WordPress and WooCommerce plugins that integrate with widely used marketing and e-commerce platforms, concentrating on form-building and product-customization tools with direct access to user data and checkout flows. Its vulnerability profile recurs through application-layer weaknesses including cross-site scripting, unsafe deserialization, authentication bypasses, and code-injection flaws, and frequently acquires public exploit code. Current severity and exploitation metrics are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Yikesinc over time
Signals from CVEs in this vendor scope (11 CVEs).
11 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2023-2518MEDIUM The Easy Forms for Mailchimp WordPress plugin before 6.8.9 does not sanitise and escape a parameter before outputting it back in the page when the debug option is enabled, leading | May 30, 2023 | 6.1 | 29 | NO | YES |
CVE-2022-28666MEDIUM Broken Access Control vulnerability in YIKES Inc. Custom Product Tabs for WooCommerce plugin <= 1.7.7 at WordPress leading to &yikes-the-content-toggle option update. | Jul 21, 2022 | 5.3 | 29 | NO | YES |
CVE-2019-15318CRITICAL The yikes-inc-easy-mailchimp-extender plugin before 6.5.3 for WordPress has code injection via the admin input field. | Aug 22, 2019 | 9.8 | 29 | NO | NO |
CVE-2024-11465HIGH The Custom Product Tabs for WooCommerce plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.8.5 via deserialization of untrusted inpu | Jan 7, 2025 | 7.2 | 22 | NO | NO |
CVE-2021-24985MEDIUM The Easy Forms for Mailchimp WordPress plugin before 6.8.6 does not sanitise and escape the field_name and field_type parameters before outputting them back in attributes, leading | Jan 24, 2022 | 6.1 | 22 | NO | NO |
CVE-2023-1324MEDIUM The Easy Forms for Mailchimp WordPress plugin before 6.8.8 does not sanitise and escape some parameters before outputting them back in the response, leading to a Reflected Cross-Si | Apr 24, 2023 | 6.1 | 21 | NO | NO |
CVE-2023-1325MEDIUM The Easy Forms for Mailchimp WordPress plugin before 6.8.7 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortc | Apr 17, 2023 | 5.4 | 21 | NO | NO |
CVE-2022-43463MEDIUM Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Custom Product Tabs for WooCommerce plugin <= 1.7.9 on WordPress. | Nov 18, 2022 | 4.8 | 19 | NO | NO |
CVE-2023-23900MEDIUM Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in YIKES, Inc. Easy Forms for Mailchimp plugin <= 6.8.8 versions. | Aug 10, 2023 | 6.1 | 18 | NO | NO |
CVE-2023-4925MEDIUM The Easy Forms for Mailchimp WordPress plugin through 6.8.10 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cros | Jan 15, 2024 | 4.8 | 16 | NO | NO |
Signals from CVEs in this vendor scope (11 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Yikesinc.
Media articles that mention a CVE ID that affects a product developed by Yikesinc — matched by CVE ID, not by vendor name.