Skip to content
OpenAdvisories

Vendor

WebToffee

60 known vulnerabilities.

Products

Order Export & Order Import for WooCommerce 8 Export and Import Users and Customers 7 WordPress Backup & Migration 6 WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels 5 Product Import Export for WooCommerce – Import Export Product CSV Suite 4 Product Import Export for WooCommerce 4 WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels 4 Product Feed for WooCommerce 3 Comments Import & Export 3 WebToffee WP Backup and Migration 2 Smart Coupons for WooCommerce 2 WordPress Comments Import & Export 2 Import Export WordPress Users 2 Wishlist for WooCommerce 1 Stripe Payment Plugin for WooCommerce 1 WebToffee eCommerce Marketing Automation 1 Decorator – WooCommerce Email Customizer 1 WooCommerce Shipping Label 1 Alt Text Generator AI – Auto Generate & Bulk Update Alt Texts For Images 1 Accessibility Toolkit by WebYes 1 Product Reviews Import Export for WooCommerce 1
All Critical High Medium Low Exploited only Public exploit

19 results · Clear filters · Feed

  • High 8.8
    CVE-2026-104368

    Export and Import Users and Customers <= 2.7.5 - Authenticated (Subscriber+) Privilege Escalation via CSV Escape-Character Mismatch in Export/Import Round Trip via Biographical Info Field

    The Export and Import Users and Customers plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.7.5 via the plugin's own export and re-import workflow. The vulnerability exists because of a CSV escape-character mis…

    WebToffee Export and Import Users and Customers Web / CMS
  • High 7.5
    CVE-2026-93746

    WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels <= 5.0.2 - Insecure Direct Object Reference to Unauthenticated Unauthorized Order Document Access via 'email' Parameter

    The WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 5.0.2 via the 'email' parameter of the guest print_document_from_t…

    WebToffee WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels Web / CMS
  • High 7.5
    CVE-2026-97197

    WordPress WordPress Backup & Migration plugin <= 1.6.0 - Broken Access Control vulnerability

    Unauthenticated Broken Access Control in WordPress Backup & Migration <= 1.6.0 versions.

    WebToffee WordPress Backup & Migration Web / CMS
  • High 7.5
    CVE-2026-49056

    WordPress WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels plugin <= 4.9.4 - Sensitive Data Exposure vulnerability

    Unauthenticated Sensitive Data Exposure in WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels <= 4.9.4 versions.

    WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels Web / CMS
  • High 7.5
    CVE-2026-45438

    WordPress Smart Coupons for WooCommerce plugin < 2.3.0 - Broken Access Control vulnerability

    Missing Authorization vulnerability in WebToffee Smart Coupons for WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Smart Coupons for WooCommerce: from n/a before 2.3.0.

    WebToffee Smart Coupons for WooCommerce Web / CMS
  • High 7.7
    CVE-2026-32441

    WordPress Comments Import & Export plugin <= 2.4.9 - Broken Access Control vulnerability

    Missing Authorization vulnerability in WebToffee Comments Import & Export comments-import-export-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Comments Import & Export: from n/a through <= 2.4.9.

    WebToffee Comments Import & Export
  • High 7.2
    CVE-2026-22480

    WordPress Product Feed for WooCommerce plugin <= 2.3.3 - PHP Object Injection vulnerability

    Deserialization of Untrusted Data vulnerability in WebToffee Product Feed for WooCommerce webtoffee-product-feed allows Object Injection.This issue affects Product Feed for WooCommerce: from n/a through <= 2.3.3.

    WebToffee Product Feed for WooCommerce Web / CMS
  • High 7.2
    CVE-2025-1913 Public exploit

    Product Import Export for WooCommerce <= 2.5.0 - Authenticated (Admin+) PHP Object Injection via form_data Parameter

    The Product Import Export for WooCommerce – Import Export Product CSV Suite plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.5.0 via deserialization of untrusted input from the 'form_data' parameter This makes…

    WebToffee Product Import Export for WooCommerce – Import Export Product CSV Suite Web / CMS
  • High 7.6
    CVE-2025-1912

    Product Import Export for WooCommerce <= 2.5.0 - Authenticated (Administrator+) Server-Side Request Forgery via validate_file Function

    The Product Import Export for WooCommerce – Import Export Product CSV Suite plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.5.0 via the validate_file() Function. This makes it possible for authenticate…

    WebToffee Product Import Export for WooCommerce – Import Export Product CSV Suite Web / CMS
  • High 7.6
    CVE-2025-1970

    Export and Import Users and Customers <= 2.6.2 - Authenticated (Administrator+) Server-Side Request Forgery via validate_file Function

    The Export and Import Users and Customers plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.6.2 via the validate_file() function. This makes it possible for authenticated attackers, with Administrator-le…

    WebToffee Export and Import Users and Customers Web / CMS
  • High 7.2
    CVE-2025-1971

    Export and Import Users and Customers <= 2.6.2 - Authenticated (Admin+) PHP Object Injection via form_data Parameter

    The Export and Import Users and Customers plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.6.2 via deserialization of untrusted input from the 'form_data' parameter. This makes it possible for authenticated at…

    WebToffee Export and Import Users and Customers Web / CMS
  • High 7.2
    CVE-2024-13921

    Order Export & Order Import for WooCommerce <= 2.6.0 - Authenticated (Admin+) PHP Object Injection via form_data Parameter

    The Order Export & Order Import for WooCommerce plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.6.0 via deserialization of untrusted input from the 'form_data' parameter. This makes it possible for authentica…

    WebToffee Order Export & Order Import for WooCommerce Web / CMS
  • High 7.6
    CVE-2024-13923

    Order Export & Order Import for WooCommerce <= 2.6.0 - Authenticated (Administrator+) Server-Side Request Forgery via validate_file Function

    The Order Export & Order Import for WooCommerce plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.6.0 via the validate_file() function. This makes it possible for authenticated attackers, with Administra…

    WebToffee Order Export & Order Import for WooCommerce Web / CMS
  • High 7.2
    CVE-2023-51546

    WordPress WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels plugin <= 4.2.1 - Privilege Escalation vulnerability

    Improper Privilege Management vulnerability in WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels allows Privilege Escalation.This issue affects WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels: fr…

    WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels Web / CMS
  • High 7.1
    CVE-2024-22288

    WordPress WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels plugin <= 4.4.0 - Reflected Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels allows Reflected XSS.This issue affects WooCommerce PDF Invoices, Packi…

    WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels Web / CMS
  • High 8.0
    CVE-2024-22135

    WordPress Order Export & Order Import for WooCommerce Plugin <= 2.4.3 is vulnerable to Arbitrary File Upload

    Unrestricted Upload of File with Dangerous Type vulnerability in WebToffee Order Export & Order Import for WooCommerce.This issue affects Order Export & Order Import for WooCommerce: from n/a through 2.4.3.

    WebToffee Order Export & Order Import for WooCommerce Web / CMS
  • High 8.0
    CVE-2024-22152

    WordPress Product Import Export for WooCommerce Plugin <= 2.3.7 is vulnerable to Arbitrary File Upload

    Unrestricted Upload of File with Dangerous Type vulnerability in WebToffee Product Import Export for WooCommerce.This issue affects Product Import Export for WooCommerce: from n/a through 2.3.7.

    WebToffee Product Import Export for WooCommerce Web / CMS
  • High 7.2
    CVE-2023-6558

    Export and Import Users and Customers <= 2.4.8 - Authenticated (Shop Manager+) Arbitrary File Upload

    The Export and Import Users and Customers plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation on the 'upload_import_file' function in versions up to, and including, 2.4.8. This makes it possible for authentica…

    WebToffee Export and Import Users and Customers Web / CMS
  • High 7.2
    CVE-2023-3459

    Export and Import Users and Customers <= 2.4.1 - Missing Authorization to Authenticated (Shop Manager) Arbitrary User Password Change

    The Export and Import Users and Customers plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'hf_update_customer' function called via an AJAX action in versions up to, and including, 2.4.1. This ma…

    WebToffee Export and Import Users and Customers Web / CMS