Webtoffee vulnerabilities

Products

• Import Export Wordpress Users 9
• Order Export & Order Import For Woocommerce 8
• Wordpress Backup & Migration 8
• Export And Import Users And Customers 7
• Product Import Export For Woocommerce 6
• Woocommerce Pdf Invoices\, Packing Slips\, Delivery Notes And Shipping Labels 6
• Order Export \& Order Import For Woocommerce 5
• Woocommerce Pdf Invoices, Packing Slips, Delivery Notes & Shipping Labels 5
• Backup And Migration 4
• Comments Import & Export 4
• Product Import Export For Woocommerce 4
• Product Import Export For Woocommerce – Import Export Product Csv Suite 4
• Woocommerce Pdf Invoices, Packing Slips, Delivery Notes And Shipping Labels 4
• Product Feed For Woocommerce 3
• Stripe Payment Plugin For Woocommerce 3
• Gdpr Cookie Consent 2
• Import Export Wordpress Users 2
• Smart Coupons For Woocommerce 2
• Wordpress Comments Import And Export 2
• Wordpress Comments Import & Export 2

Newest

• webtoffee wp backup and migration WebToffee WP Backup and Migration <= 1.6.1 - Authenticated (Subscriber+) SQL Injection via User Profile Biography CVE-2026-120530 5.7 MediumNovember 7, 2026
• webtoffee export and import users and customers Export and Import Users and Customers <= 2.7.5 - Authenticated (Subscriber+) Privilege Escalation via CSV Escape-Character Mismatch in Export/Import Round Trip via Biographical Info Field CVE-2026-104368 8.8 HighOctober 30, 2026
• webtoffee product import export for woocommerce WebToffee Product Import Export for WooCommerce 2.5.1 before 2.6.8 SSRF via Redirects CVE-2026-118989 5.1 MediumOctober 29, 2026
• webtoffee woocommerce pdf invoices, packing slips, delivery notes & shipping labels WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels <= 5.0.2 - Insecure Direct Object Reference to Unauthenticated Unauthorized Order Document Access via 'email' Parame… CVE-2026-93746 7.5 HighOctober 10, 2026
• webtoffee order export & order import for woocommerce Order Export & Order Import for WooCommerce <= 2.7.8 - Unauthenticated Sensitive File Exposure via Missing Directory Guard Re-verification in get_file_path() CVE-2026-94375 5.3 MediumOctober 10, 2026
• webtoffee wordpress backup & migration WordPress WordPress Backup & Migration plugin <= 1.6.0 - Broken Access Control vulnerability CVE-2026-97197 7.5 HighSeptember 30, 2026
• unknown comments import & export Comments Import & Export 2.1.11 - 2.5.3 - Author+ Comment PII Disclosure via Export CVE-2026-87836 2.7 LowSeptember 17, 2026
• webtoffee woocommerce pdf invoices, packing slips, delivery notes & shipping labels WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels <= 4.9.8 - Authenticated (Subscriber+) Arbitrary File Read via 'customer_note' Parameter CVE-2026-18027 6.5 MediumAugust 22, 2026
• webtoffee woocommerce pdf invoices, packing slips, delivery notes and shipping labels WordPress WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels plugin <= 4.9.4 - Sensitive Data Exposure vulnerability CVE-2026-49056 7.5 HighJune 15, 2026
• webtoffee product import export for woocommerce WordPress Product Import Export for WooCommerce plugin <= 2.5.6 - Broken Access Control vulnerability CVE-2026-48971 4.3 MediumMay 27, 2026
• webtoffee smart coupons for woocommerce WordPress Smart Coupons for WooCommerce plugin < 2.3.0 - Broken Access Control vulnerability CVE-2026-45438 7.5 HighMay 25, 2026
• webtoffee comments import & export WordPress Comments Import & Export plugin <= 2.4.9 - Broken Access Control vulnerability CVE-2026-32441 7.7 HighMarch 25, 2026
• webtoffee product feed for woocommerce WordPress Product Feed for WooCommerce plugin <= 2.3.3 - PHP Object Injection vulnerability CVE-2026-22480 7.2 HighMarch 25, 2026
• webtoffee ecommerce marketing automation WordPress WebToffee eCommerce Marketing Automation plugin <= 2.1.1 - Broken Access Control vulnerability CVE-2025-67599 4.3 MediumDecember 9, 2025
• webtoffee accessibility toolkit by webyes WordPress Accessibility Toolkit by WebYes plugin <= 2.0.4 - Broken Access Control vulnerability CVE-2025-66112 4.3 MediumNovember 21, 2025
• webtoffee product feed for woocommerce WordPress Product Feed for WooCommerce plugin <= 2.3.1 - Broken Access Control vulnerability CVE-2025-66089 4.3 MediumNovember 21, 2025
• webtoffee order export & order import for woocommerce WordPress Order Export & Order Import for WooCommerce plugin <= 2.6.7 - Broken Access Control vulnerability CVE-2025-64382 4.3 MediumNovember 13, 2025
• webtoffee alt text generator ai – auto generate & bulk update alt texts for images Alt Text Generator AI – Auto Generate & Bulk Update Alt Texts For Images <= 1.8.3 - Missing Authorization to Authenticated (Subscriber+) API Key Deletion CVE-2025-12113 4.3 MediumNovember 12, 2025
• webtoffee smart coupons for woocommerce WordPress Smart Coupons for WooCommerce plugin <= 2.2.3 - Broken Access Control vulnerability CVE-2025-64358 4.3 MediumOctober 31, 2025
• webtoffee product feed for woocommerce WordPress Product Feed for WooCommerce plugin <= 2.2.8 - Broken Access Control Vulnerability CVE-2025-49287 4.3 MediumJune 6, 2025
• webtoffee comments import & export WordPress Comments Import & Export <= 2.4.3 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting CVE-2025-3919 6.4 MediumJune 2, 2025
• unknown webtoffee-gdpr-cookie-consent, webtoffee gdpr cookie consent +1 more GDPR Cookie Consent <= 2.6.0 - Unauthenticated Stored XSS CVE-2024-8397 5.4 MediumMay 15, 2025
• unknown webtoffee-gdpr-cookie-consent, webtoffee gdpr cookie consent +1 more GDPR Cookie Consent <= 2.6.0 - Bulk Delete via CSRF CVE-2024-8286 6.5 MediumMay 15, 2025
• webtoffee wordpress backup & migration WordPress WebToffee WP Backup and Migration plugin <= 1.5.3 - Sensitive Data Exposure vulnerability CVE-2025-24651 5.9 MediumApril 17, 2025
• webtoffee product import export for woocommerce – import export product csv suite, product import export for woocommerce +1 more Product Import Export for WooCommerce <= 2.5.0 - Authenticated (Admin+) PHP Object Injection via form_data Parameter CVE-2025-1913 Public exploit 7.2 HighMarch 26, 2025
• webtoffee product import export for woocommerce – import export product csv suite, product import export for woocommerce +1 more Product Import Export for WooCommerce <= 2.5.0 - Directory Traversal to Authenticated (Administrator+) Limited Arbitrary File Deletion via admin_log_page Function CVE-2025-1911 2.7 LowMarch 26, 2025
• webtoffee product import export for woocommerce – import export product csv suite, product import export for woocommerce +1 more Product Import Export for WooCommerce <= 2.5.0 - Authenticated (Administrator+) Server-Side Request Forgery via validate_file Function CVE-2025-1912 7.6 HighMarch 26, 2025
• webtoffee product import export for woocommerce – import export product csv suite, product import export for woocommerce +1 more Product Import Export for WooCommerce <= 2.5.0 - Directory Traversal to Authenticated (Administrator+) Limited Arbitrary File Read via download_file Function CVE-2025-1769 4.9 MediumMarch 26, 2025
• webtoffee export and import users and customers, import export wordpress users +1 more Export and Import Users and Customers <= 2.6.2 - Directory Traversal to Authenticated (Administrator+) Limited Arbitrary File Read via download_file Function CVE-2025-1973 4.9 MediumMarch 22, 2025
• webtoffee export and import users and customers, import export wordpress users +1 more Export and Import Users and Customers <= 2.6.2 - Authenticated (Administrator+) Server-Side Request Forgery via validate_file Function CVE-2025-1970 7.6 HighMarch 22, 2025
• webtoffee export and import users and customers, import export wordpress users +1 more Export and Import Users and Customers <= 2.6.2 - Directory Traversal to Authenticated (Administrator+) Limited Arbitrary File Deletion via admin_log_page Function CVE-2025-1972 2.7 LowMarch 22, 2025
• webtoffee export and import users and customers, import export wordpress users +1 more Export and Import Users and Customers <= 2.6.2 - Authenticated (Admin+) PHP Object Injection via form_data Parameter CVE-2025-1971 7.2 HighMarch 22, 2025
• webtoffee order export & order import for woocommerce, order export \& order import for woocommerce +1 more Order Export & Order Import for WooCommerce <= 2.6.0 - Directory Traversal to Authenticated (Administrator+) Limited Arbitrary File Read via download_file Function CVE-2024-13920 4.9 MediumMarch 20, 2025
• webtoffee order export & order import for woocommerce, order export \& order import for woocommerce +1 more Order Export & Order Import for WooCommerce <= 2.6.0 - Authenticated (Admin+) PHP Object Injection via form_data Parameter CVE-2024-13921 7.2 HighMarch 20, 2025
• webtoffee order export & order import for woocommerce, order export \& order import for woocommerce +1 more Order Export & Order Import for WooCommerce <= 2.6.0 - Directory Traversal to Authenticated (Administrator+) Limited Arbitrary File Deletion via admin_log_page Function CVE-2024-13922 2.7 LowMarch 20, 2025
• webtoffee order export & order import for woocommerce, order export \& order import for woocommerce +1 more Order Export & Order Import for WooCommerce <= 2.6.0 - Authenticated (Administrator+) Server-Side Request Forgery via validate_file Function CVE-2024-13923 7.6 HighMarch 20, 2025
• webtoffee wishlist for woocommerce WordPress Wishlist for WooCommerce plugin <=2.1.2 - Cross Site Scripting (XSS) vulnerability CVE-2025-24657 5.9 MediumJanuary 24, 2025
• webtoffee woocommerce pdf invoices, packing slips, delivery notes and shipping labels, woocommerce pdf invoices\, packing slips\, delivery notes and shipping labels +1 more WordPress WooCommerce PDF Invoices plugin <= 4.7.1 - Stored Cross Site Scripting (XSS) vulnerability CVE-2025-24644 5.9 MediumJanuary 24, 2025
• webtoffee wordpress backup & migration WordPress Backup & Migration plugin <= 1.4.1 - Broken Access Control vulnerability CVE-2023-45636 5.4 MediumJanuary 2, 2025
• webtoffee wordpress backup & migration WordPress WordPress Backup & Migration plugin <= 1.4.0 - Broken Access Control vulnerability CVE-2023-33928 4.3 MediumDecember 13, 2024
• webtoffee comments import & export WordPress Comments Import & Export <= 2.3.7 - Authenticated (Author+) Arbitrary File Read via Directory Traversal CVE-2024-7514 Public exploit 6.5 MediumOctober 11, 2024
• carazo import and export users and customers WordPress Import and export users and customers plugin <= 1.26.5 - Broken Access Control vulnerability CVE-2024-34815 5.4 MediumJune 11, 2024
• webtoffee wordpress backup & migration WordPress WordPress Backup & Migration plugin <= 1.4.3 - Broken Access Control vulnerability CVE-2023-52183 5.4 MediumJune 11, 2024
• webtoffee woocommerce pdf invoices, packing slips, delivery notes and shipping labels, woocommerce pdf invoices\, packing slips\, delivery notes and shipping labels +1 more WordPress WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels plugin <= 4.2.1 - Privilege Escalation vulnerability CVE-2023-51546 7.2 HighMay 17, 2024
• webtoffee order export & order import for woocommerce WordPress Order Export & Order Import for WooCommerce plugin <= 2.4.9 - PHP Object Injection vulnerability CVE-2024-34751 4.4 MediumMay 16, 2024
• webtoffee backup and migration, wp backup and migration +1 more WordPress Backup & Migration <= 1.4.8 - Missing Authorization to Directory Traversal CVE-2024-3546 4.3 MediumMay 2, 2024
• webtoffee woocommerce shipping label WordPress WooCommerce Shipping Label plugin <= 2.3.8 - Cross Site Scripting (XSS) vulnerability CVE-2024-32834 5.9 MediumApril 24, 2024
• webtoffee import export wordpress users WordPress Export and Import Users and Customers plugin <= 2.5.3 - Deserialization of untrusted data vulnerability CVE-2024-32835 5.4 MediumApril 24, 2024
• webtoffee wordpress comments import & export WordPress Comments Import & Export plugin <= 2.3.5 - Cross Site Request Forgery (CSRF) vulnerability CVE-2024-31235 4.3 MediumApril 12, 2024
• webtoffee wordpress backup & migration, backup and migration +1 more WordPress WordPress Backup & Migration plugin <= 1.4.7 - Sensitive Data Exposure via Log File vulnerability CVE-2024-31254 3.7 LowApril 10, 2024
• Show olderLoading…