Webtoffee
62 CVEs across 31 Webtoffee products. Browse Webtoffee vulnerabilities, severities, and proof-of-concept exploits.
Webtoffee products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-49056 | High | 7.5 | 2026-06-15 | Unauthenticated Sensitive Data Exposure in WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels <= 4.9.4 versions. |
CVE-2026-48971 | Medium | 4.3 | 2026-05-27 | Missing Authorization vulnerability in WebToffee Product Import Export for WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels… |
CVE-2026-45438 | High | 7.5 | 2026-05-25 | Missing Authorization vulnerability in WebToffee Smart Coupons for WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels. This i… |
CVE-2026-32441 | High | 7.7 | 2026-03-25 | Missing Authorization vulnerability in WebToffee Comments Import & Export comments-import-export-woocommerce allows Exploiting Incorrectly Configured Access Co… |
CVE-2026-22480 | High | 7.2 | 2026-03-25 | Deserialization of Untrusted Data vulnerability in WebToffee Product Feed for WooCommerce webtoffee-product-feed allows Object Injection.This issue affects Pro… |
CVE-2025-67599 | Medium | 4.3 | 2025-12-09 | Missing Authorization vulnerability in WebToffee WebToffee eCommerce Marketing Automation decorator-woocommerce-email-customizer allows Exploiting Incorrectly… |
CVE-2025-66112 | Medium | 4.3 | 2025-11-21 | Missing Authorization vulnerability in WebToffee Accessibility Toolkit by WebYes accessibility-plus allows Exploiting Incorrectly Configured Access Control Sec… |
CVE-2025-66089 | Medium | 4.3 | 2025-11-21 | Missing Authorization vulnerability in WebToffee Product Feed for WooCommerce webtoffee-product-feed allows Exploiting Incorrectly Configured Access Control Se… |
CVE-2025-64382 | Medium | 4.3 | 2025-11-13 | Missing Authorization vulnerability in WebToffee Order Export & Order Import for WooCommerce order-import-export-for-woocommerce allows Exploiting Incorrectly… |
CVE-2025-12113 | Medium | 4.3 | 2025-11-12 | The Alt Text Generator AI – Auto Generate & Bulk Update Alt Texts For Images plugin for WordPress is vulnerable to unauthorized loss of data due to a missing c… |
CVE-2025-64358 | Medium | 4.3 | 2025-10-31 | Missing Authorization vulnerability in WebToffee Smart Coupons for WooCommerce wt-smart-coupons-for-woocommerce allows Exploiting Incorrectly Configured Access… |
CVE-2025-49287 | Medium | 4.3 | 2025-06-06 | Missing Authorization vulnerability in WebToffee Product Feed for WooCommerce webtoffee-product-feed allows Exploiting Incorrectly Configured Access Control Se… |
CVE-2025-3919 | Medium | 6.4 | 2025-06-02 | The WordPress Comments Import & Export plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the save_se… |
CVE-2024-8397 | Medium | 5.4 | 2025-05-15 | The webtoffee-gdpr-cookie-consent WordPress plugin before 2.6.1 does not properly sanitize and escape the IP headers when logging them, allowing visitors to co… |
CVE-2024-8286 | Medium | 6.5 | 2025-05-15 | The webtoffee-gdpr-cookie-consent WordPress plugin before 2.6.1 does not have CSRF checks in some bulk actions, which could allow attackers to make logged in a… |
CVE-2025-24651 | Medium | 5.9 | 2025-04-17 | Insertion of Sensitive Information into Log File vulnerability in WebToffee WordPress Backup & Migration wp-migration-duplicator allows Retrieve Embedded Sensi… |
CVE-2025-1913 | High | 7.2 | 2025-03-26 | The Product Import Export for WooCommerce – Import Export Product CSV Suite plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, a… |
CVE-2025-1912 | High | 7.6 | 2025-03-26 | The Product Import Export for WooCommerce – Import Export Product CSV Suite plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions u… |
CVE-2025-1911 | Low | 2.7 | 2025-03-26 | The Product Import Export for WooCommerce – Import Export Product CSV Suite plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient f… |
CVE-2025-1769 | Medium | 4.9 | 2025-03-26 | The Product Import Export for WooCommerce – Import Export Product CSV Suite plugin for WordPress is vulnerable to Directory Traversal in all versions up to, an… |
CVE-2025-1973 | Medium | 4.9 | 2025-03-22 | The Export and Import Users and Customers plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 2.6.2 via the download_fil… |
CVE-2025-1972 | Low | 2.7 | 2025-03-22 | The Export and Import Users and Customers plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the admin_l… |
CVE-2025-1971 | High | 7.2 | 2025-03-22 | The Export and Import Users and Customers plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.6.2 via deserializ… |
CVE-2025-1970 | High | 7.6 | 2025-03-22 | The Export and Import Users and Customers plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.6.2 via the… |
CVE-2024-13923 | High | 7.6 | 2025-03-20 | The Order Export & Order Import for WooCommerce plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.6.0 v… |
CVE-2024-13922 | Low | 2.7 | 2025-03-20 | The Order Export & Order Import for WooCommerce plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the a… |
CVE-2024-13921 | High | 7.2 | 2025-03-20 | The Order Export & Order Import for WooCommerce plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.6.0 via dese… |
CVE-2024-13920 | Medium | 4.9 | 2025-03-20 | The Order Export & Order Import for WooCommerce plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.6.0 via the d… |
CVE-2025-24657 | Medium | 5.9 | 2025-01-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WebToffee Wishlist for WooCommerce wt-woocommerce-wishlis… |
CVE-2025-24644 | Medium | 5.9 | 2025-01-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WebToffee WooCommerce PDF Invoices, Packing Slips, Delive… |
CVE-2023-45636 | Medium | 5.4 | 2025-01-02 | Missing Authorization vulnerability in WebToffee WordPress Backup & Migration wp-migration-duplicator allows Exploiting Incorrectly Configured Access Control S… |
CVE-2023-33928 | Medium | 4.3 | 2024-12-13 | Missing Authorization vulnerability in WebToffee WordPress Backup & Migration allows Exploiting Incorrectly Configured Access Control Security Levels.This issu… |
CVE-2024-7514 | Medium | 6.5 | 2024-10-11 | The WordPress Comments Import & Export plugin for WordPress is vulnerable to to arbitrary file read due to insufficient file path validation during the comment… |
CVE-2023-52183 | Medium | 5.4 | 2024-06-11 | Missing Authorization vulnerability in WebToffee WordPress Backup & Migration.This issue affects WordPress Backup & Migration: from n/a through 1.4.3. |
CVE-2023-51546 | High | 7.2 | 2024-05-17 | Improper Privilege Management vulnerability in WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels allows Privilege Escalatio… |
CVE-2024-34751 | Medium | 4.4 | 2024-05-16 | Deserialization of Untrusted Data vulnerability in WebToffee Order Export & Order Import for WooCommerce.This issue affects Order Export & Order Import for Woo… |
CVE-2024-3546 | Medium | 4.3 | 2024-05-02 | The WordPress Backup & Migration plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the wp_mgdp_populate_po… |
CVE-2024-32834 | Medium | 5.9 | 2024-04-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WebToffee WooCommerce Shipping Label allows Stored XSS.Th… |
CVE-2024-32835 | Medium | 5.4 | 2024-04-24 | Deserialization of Untrusted Data vulnerability in WebToffee Import Export WordPress Users.This issue affects Import Export WordPress Users: from n/a through 2… |
CVE-2024-31235 | Medium | 4.3 | 2024-04-12 | Cross-Site Request Forgery (CSRF) vulnerability in WebToffee WordPress Comments Import & Export.This issue affects WordPress Comments Import & Export: from n/a… |
CVE-2024-31254 | Low | 3.7 | 2024-04-10 | Insertion of Sensitive Information into Log File vulnerability in WebToffee WordPress Backup & Migration.This issue affects WordPress Backup & Migration: from… |
CVE-2024-3216 | Medium | 5.3 | 2024-04-06 | The WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels plugin for WordPress is vulnerable to unauthorized modification of data due to… |
CVE-2024-30492 | Medium | 4.3 | 2024-03-29 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in WebToffee Import Export WordPress Users.This issue affects Impo… |
CVE-2024-22288 | High | 7.1 | 2024-03-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WebToffee WooCommerce PDF Invoices, Packing Slips, Delive… |
CVE-2024-30231 | Critical | 9.1 | 2024-03-26 | Unrestricted Upload of File with Dangerous Type vulnerability in WebToffee Product Import Export for WooCommerce.This issue affects Product Import Export for W… |
CVE-2024-0957 | Medium | 6.1 | 2024-03-22 | The WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Custo… |
CVE-2024-22152 | High | 8.0 | 2024-01-24 | Unrestricted Upload of File with Dangerous Type vulnerability in WebToffee Product Import Export for WooCommerce.This issue affects Product Import Export for W… |
CVE-2024-22135 | High | 8.0 | 2024-01-24 | Unrestricted Upload of File with Dangerous Type vulnerability in WebToffee Order Export & Order Import for WooCommerce.This issue affects Order Export & Order… |
CVE-2024-0705 | Critical | 9.8 | 2024-01-19 | The Stripe Payment Plugin for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the 'id' parameter in all versions up to, and including, 3.7… |
CVE-2023-6558 | High | 7.2 | 2024-01-11 | The Export and Import Users and Customers plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation on the 'upload_… |
CVE-2023-7068 | Medium | 4.3 | 2024-01-03 | The WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels plugin for WordPress is vulnerable to unauthorized access of data due to a miss… |
CVE-2023-48284 | Medium | 4.3 | 2023-11-30 | Cross-Site Request Forgery (CSRF) vulnerability in WebToffee Decorator – WooCommerce Email Customizer allows Cross Site Request Forgery.This issue affects Deco… |
CVE-2023-5738 | Medium | 5.4 | 2023-11-27 | The WordPress Backup & Migration WordPress plugin before 1.4.4 does not sanitise and escape some parameters, which could allow users with a role as low as Subs… |
CVE-2023-5737 | Medium | 4.3 | 2023-11-27 | The WordPress Backup & Migration WordPress plugin before 1.4.4 does not authorize some AJAX requests, allowing users with a role as low as Subscriber to update… |
CVE-2022-45370 | Medium | 6.1 | 2023-11-07 | Improper Neutralization of Formula Elements in a CSV File vulnerability in WebToffee WordPress Comments Import & Export.This issue affects WordPress Comments I… |
CVE-2022-46802 | Medium | 6.1 | 2023-11-07 | Improper Neutralization of Formula Elements in a CSV File vulnerability in WebToffee Product Reviews Import Export for WooCommerce.This issue affects Product R… |
CVE-2023-3162 | Critical | 9.8 | 2023-08-31 | The Stripe Payment Plugin for WooCommerce plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 3.7.7. This is due to i… |
CVE-2023-4040 | Medium | 5.3 | 2023-08-18 | The Stripe Payment Plugin for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the eh_c… |
CVE-2023-3459 | High | 7.2 | 2023-07-18 | The Export and Import Users and Customers plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'hf_… |
CVE-2020-12074 | High | 8.8 | 2020-04-23 | The users-customers-import-export-for-wp-woocommerce plugin before 1.3.9 for WordPress allows subscribers to import administrative accounts via CSV. |
CVE-2019-15092 | High | 7.3 | 2019-08-23 | The webtoffee "WordPress Users & WooCommerce Customers Import Export" plugin 1.3.0 for WordPress allows CSV injection in the user_url, display_name, first_name… |
CVE-2018-11526 | High | 7.8 | 2018-06-19 | The plugin "WordPress Comments Import & Export" for WordPress (v2.0.4 and before) is vulnerable to CSV Injection. |