Webtoffee vulnerabilities
60 CVEs and advisories name Webtoffee as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-120530WebToffee WP Backup and Migration <= 1.6.1 - Authenticated (Subscriber+) SQL Injection via User Profile Biography
- CVE-2026-104368Export and Import Users and Customers <= 2.7.5 - Authenticated (Subscriber+) Privilege Escalation via CSV Escape-Character Mismatch in…
- CVE-2026-118989WebToffee Product Import Export for WooCommerce 2.5.1 before 2.6.8 SSRF via Redirects
- CVE-2026-93746WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels <= 5.0.2 - Insecure Direct Object Reference to Unauthenticated Unauthorized Order Document Access via 'email' Parameter
- CVE-2026-94375Order Export & Order Import for WooCommerce <= 2.7.8 - Unauthenticated Sensitive File Exposure via Missing Directory Guard Re-verification in get_file_path()
- CVE-2026-97197WordPress WordPress Backup & Migration plugin <= 1.6.0 - Broken Access Control vulnerability
- CVE-2026-18027WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels <= 4.9.8 - Authenticated (Subscriber+) Arbitrary File Read via 'customer_note' Parameter
- CVE-2026-49056WordPress WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels plugin <= 4.9.4 - Sensitive Data Exposure vulnerability
- CVE-2026-48971WordPress Product Import Export for WooCommerce plugin <= 2.5.6 - Broken Access Control vulnerability
- CVE-2026-45438WordPress Smart Coupons for WooCommerce plugin < 2.3.0 - Broken Access Control vulnerability
- CVE-2026-32441WordPress Comments Import & Export plugin <= 2.4.9 - Broken Access Control vulnerability
- CVE-2026-22480WordPress Product Feed for WooCommerce plugin <= 2.3.3 - PHP Object Injection vulnerability
- CVE-2025-67599WordPress WebToffee eCommerce Marketing Automation plugin <= 2.1.1 - Broken Access Control vulnerability
- CVE-2025-66112WordPress Accessibility Toolkit by WebYes plugin <= 2.0.4 - Broken Access Control vulnerability
- CVE-2025-66089WordPress Product Feed for WooCommerce plugin <= 2.3.1 - Broken Access Control vulnerability
- CVE-2025-64382WordPress Order Export & Order Import for WooCommerce plugin <= 2.6.7 - Broken Access Control vulnerability
- CVE-2025-12113Alt Text Generator AI – Auto Generate & Bulk Update Alt Texts For Images <= 1.8.3 - Missing Authorization to Authenticated (Subscriber+) API Key Deletion
- CVE-2025-64358WordPress Smart Coupons for WooCommerce plugin <= 2.2.3 - Broken Access Control vulnerability
- CVE-2025-49287WordPress Product Feed for WooCommerce plugin <= 2.2.8 - Broken Access Control Vulnerability
- CVE-2025-3919WordPress Comments Import & Export <= 2.4.3 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting
- CVE-2025-24651WordPress WebToffee WP Backup and Migration plugin <= 1.5.3 - Sensitive Data Exposure vulnerability
- CVE-2025-1913Product Import Export for WooCommerce <= 2.5.0 - Authenticated (Admin+) PHP Object Injection via form_data Parameter
- CVE-2025-1911Product Import Export for WooCommerce <= 2.5.0 - Directory Traversal to Authenticated (Administrator+) Limited Arbitrary File Deletion via admin_log_page Function
- CVE-2025-1912Product Import Export for WooCommerce <= 2.5.0 - Authenticated (Administrator+) Server-Side Request Forgery via validate_file Function
- CVE-2025-1769Product Import Export for WooCommerce <= 2.5.0 - Directory Traversal to Authenticated (Administrator+) Limited Arbitrary File Read via download_file Function
- CVE-2025-1973Export and Import Users and Customers <= 2.6.2 - Directory Traversal to Authenticated (Administrator+) Limited Arbitrary File Read via download_file Function
- CVE-2025-1970Export and Import Users and Customers <= 2.6.2 - Authenticated (Administrator+) Server-Side Request Forgery via validate_file Function
- CVE-2025-1971Export and Import Users and Customers <= 2.6.2 - Authenticated (Admin+) PHP Object Injection via form_data Parameter
- CVE-2025-1972Export and Import Users and Customers <= 2.6.2 - Directory Traversal to Authenticated (Administrator+) Limited Arbitrary File Deletion via admin_log_page Function
- CVE-2024-13920Order Export & Order Import for WooCommerce <= 2.6.0 - Directory Traversal to Authenticated (Administrator+) Limited Arbitrary File Read via download_file Function