# cve.now: Webtoffee

The newest entries naming Webtoffee as an affected vendor (up to 200), of 60 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-120530](https://cve.now/CVE-2026-120530.md): WebToffee WP Backup and Migration \<= 1.6.1 - Authenticated (Subscriber+) SQL Injection via User Profile Biography (CVSS 5.7)
- [CVE-2026-104368](https://cve.now/CVE-2026-104368.md): Export and Import Users and Customers \<= 2.7.5 - Authenticated (Subscriber+) Privilege Escalation via CSV Escape-Character Mismatch in… (CVSS 8.8)
- [CVE-2026-118989](https://cve.now/CVE-2026-118989.md): WebToffee Product Import Export for WooCommerce 2.5.1 before 2.6.8 SSRF via Redirects (CVSS 5.1)
- [CVE-2026-93746](https://cve.now/CVE-2026-93746.md): WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels \<= 5.0.2 - Insecure Direct Object Reference to Unauthenticated Unauthorized Order Document Access via 'email' Parameter (CVSS 7.5)
- [CVE-2026-94375](https://cve.now/CVE-2026-94375.md): Order Export & Order Import for WooCommerce \<= 2.7.8 - Unauthenticated Sensitive File Exposure via Missing Directory Guard Re-verification in get\_file\_path() (CVSS 5.3)
- [CVE-2026-97197](https://cve.now/CVE-2026-97197.md): WordPress WordPress Backup & Migration plugin \<= 1.6.0 - Broken Access Control vulnerability (CVSS 7.5)
- [CVE-2026-18027](https://cve.now/CVE-2026-18027.md): WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels \<= 4.9.8 - Authenticated (Subscriber+) Arbitrary File Read via 'customer\_note' Parameter (CVSS 6.5)
- [CVE-2026-49056](https://cve.now/CVE-2026-49056.md): WordPress WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels plugin \<= 4.9.4 - Sensitive Data Exposure vulnerability (CVSS 7.5)
- [CVE-2026-48971](https://cve.now/CVE-2026-48971.md): WordPress Product Import Export for WooCommerce plugin \<= 2.5.6 - Broken Access Control vulnerability (CVSS 4.3)
- [CVE-2026-45438](https://cve.now/CVE-2026-45438.md): WordPress Smart Coupons for WooCommerce plugin \< 2.3.0 - Broken Access Control vulnerability (CVSS 7.5)
- [CVE-2026-32441](https://cve.now/CVE-2026-32441.md): WordPress Comments Import & Export plugin \<= 2.4.9 - Broken Access Control vulnerability (CVSS 7.7)
- [CVE-2026-22480](https://cve.now/CVE-2026-22480.md): WordPress Product Feed for WooCommerce plugin \<= 2.3.3 - PHP Object Injection vulnerability (CVSS 7.2)
- [CVE-2025-67599](https://cve.now/CVE-2025-67599.md): WordPress WebToffee eCommerce Marketing Automation plugin \<= 2.1.1 - Broken Access Control vulnerability (CVSS 4.3)
- [CVE-2025-66112](https://cve.now/CVE-2025-66112.md): WordPress Accessibility Toolkit by WebYes plugin \<= 2.0.4 - Broken Access Control vulnerability (CVSS 4.3)
- [CVE-2025-66089](https://cve.now/CVE-2025-66089.md): WordPress Product Feed for WooCommerce plugin \<= 2.3.1 - Broken Access Control vulnerability (CVSS 4.3)
- [CVE-2025-64382](https://cve.now/CVE-2025-64382.md): WordPress Order Export & Order Import for WooCommerce plugin \<= 2.6.7 - Broken Access Control vulnerability (CVSS 4.3)
- [CVE-2025-12113](https://cve.now/CVE-2025-12113.md): Alt Text Generator AI – Auto Generate & Bulk Update Alt Texts For Images \<= 1.8.3 - Missing Authorization to Authenticated (Subscriber+) API Key Deletion (CVSS 4.3)
- [CVE-2025-64358](https://cve.now/CVE-2025-64358.md): WordPress Smart Coupons for WooCommerce plugin \<= 2.2.3 - Broken Access Control vulnerability (CVSS 4.3)
- [CVE-2025-49287](https://cve.now/CVE-2025-49287.md): WordPress Product Feed for WooCommerce plugin \<= 2.2.8 - Broken Access Control Vulnerability (CVSS 4.3)
- [CVE-2025-3919](https://cve.now/CVE-2025-3919.md): WordPress Comments Import & Export \<= 2.4.3 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting (CVSS 6.4)
- [CVE-2025-24651](https://cve.now/CVE-2025-24651.md): WordPress WebToffee WP Backup and Migration plugin \<= 1.5.3 - Sensitive Data Exposure vulnerability (CVSS 5.9)
- [CVE-2025-1913](https://cve.now/CVE-2025-1913.md): Product Import Export for WooCommerce \<= 2.5.0 - Authenticated (Admin+) PHP Object Injection via form\_data Parameter (CVSS 7.2)
- [CVE-2025-1911](https://cve.now/CVE-2025-1911.md): Product Import Export for WooCommerce \<= 2.5.0 - Directory Traversal to Authenticated (Administrator+) Limited Arbitrary File Deletion via admin\_log\_page Function (CVSS 2.7)
- [CVE-2025-1912](https://cve.now/CVE-2025-1912.md): Product Import Export for WooCommerce \<= 2.5.0 - Authenticated (Administrator+) Server-Side Request Forgery via validate\_file Function (CVSS 7.6)
- [CVE-2025-1769](https://cve.now/CVE-2025-1769.md): Product Import Export for WooCommerce \<= 2.5.0 - Directory Traversal to Authenticated (Administrator+) Limited Arbitrary File Read via download\_file Function (CVSS 4.9)
- [CVE-2025-1973](https://cve.now/CVE-2025-1973.md): Export and Import Users and Customers \<= 2.6.2 - Directory Traversal to Authenticated (Administrator+) Limited Arbitrary File Read via download\_file Function (CVSS 4.9)
- [CVE-2025-1970](https://cve.now/CVE-2025-1970.md): Export and Import Users and Customers \<= 2.6.2 - Authenticated (Administrator+) Server-Side Request Forgery via validate\_file Function (CVSS 7.6)
- [CVE-2025-1971](https://cve.now/CVE-2025-1971.md): Export and Import Users and Customers \<= 2.6.2 - Authenticated (Admin+) PHP Object Injection via form\_data Parameter (CVSS 7.2)
- [CVE-2025-1972](https://cve.now/CVE-2025-1972.md): Export and Import Users and Customers \<= 2.6.2 - Directory Traversal to Authenticated (Administrator+) Limited Arbitrary File Deletion via admin\_log\_page Function (CVSS 2.7)
- [CVE-2024-13920](https://cve.now/CVE-2024-13920.md): Order Export & Order Import for WooCommerce \<= 2.6.0 - Directory Traversal to Authenticated (Administrator+) Limited Arbitrary File Read via download\_file Function (CVSS 4.9)
- [CVE-2024-13921](https://cve.now/CVE-2024-13921.md): Order Export & Order Import for WooCommerce \<= 2.6.0 - Authenticated (Admin+) PHP Object Injection via form\_data Parameter (CVSS 7.2)
- [CVE-2024-13922](https://cve.now/CVE-2024-13922.md): Order Export & Order Import for WooCommerce \<= 2.6.0 - Directory Traversal to Authenticated (Administrator+) Limited Arbitrary File Deletion via admin\_log\_page Function (CVSS 2.7)
- [CVE-2024-13923](https://cve.now/CVE-2024-13923.md): Order Export & Order Import for WooCommerce \<= 2.6.0 - Authenticated (Administrator+) Server-Side Request Forgery via validate\_file Function (CVSS 7.6)
- [CVE-2025-24657](https://cve.now/CVE-2025-24657.md): WordPress Wishlist for WooCommerce plugin \<=2.1.2 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9)
- [CVE-2025-24644](https://cve.now/CVE-2025-24644.md): WordPress WooCommerce PDF Invoices plugin \<= 4.7.1 - Stored Cross Site Scripting (XSS) vulnerability (CVSS 5.9)
- [CVE-2023-45636](https://cve.now/CVE-2023-45636.md): WordPress Backup & Migration plugin \<= 1.4.1 - Broken Access Control vulnerability (CVSS 5.4)
- [CVE-2023-33928](https://cve.now/CVE-2023-33928.md): WordPress WordPress Backup & Migration plugin \<= 1.4.0 - Broken Access Control vulnerability (CVSS 4.3)
- [CVE-2024-7514](https://cve.now/CVE-2024-7514.md): WordPress Comments Import & Export \<= 2.3.7 - Authenticated (Author+) Arbitrary File Read via Directory Traversal (CVSS 6.5)
- [CVE-2023-52183](https://cve.now/CVE-2023-52183.md): WordPress WordPress Backup & Migration plugin \<= 1.4.3 - Broken Access Control vulnerability (CVSS 5.4)
- [CVE-2023-51546](https://cve.now/CVE-2023-51546.md): WordPress WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels plugin \<= 4.2.1 - Privilege Escalation vulnerability (CVSS 7.2)
- [CVE-2024-34751](https://cve.now/CVE-2024-34751.md): WordPress Order Export & Order Import for WooCommerce plugin \<= 2.4.9 - PHP Object Injection vulnerability (CVSS 4.4)
- [CVE-2024-3546](https://cve.now/CVE-2024-3546.md): WordPress Backup & Migration \<= 1.4.8 - Missing Authorization to Directory Traversal (CVSS 4.3)
- [CVE-2024-32834](https://cve.now/CVE-2024-32834.md): WordPress WooCommerce Shipping Label plugin \<= 2.3.8 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9)
- [CVE-2024-32835](https://cve.now/CVE-2024-32835.md): WordPress Export and Import Users and Customers plugin \<= 2.5.3 - Deserialization of untrusted data vulnerability (CVSS 5.4)
- [CVE-2024-31235](https://cve.now/CVE-2024-31235.md): WordPress Comments Import & Export plugin \<= 2.3.5 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3)
- [CVE-2024-31254](https://cve.now/CVE-2024-31254.md): WordPress WordPress Backup & Migration plugin \<= 1.4.7 - Sensitive Data Exposure via Log File vulnerability (CVSS 3.7)
- [CVE-2024-3216](https://cve.now/CVE-2024-3216.md): WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels \<= 4.4.2 - Missing Authorization to Unauthenticated Settings Reset (CVSS 5.3)
- [CVE-2024-30492](https://cve.now/CVE-2024-30492.md): WordPress Export and Import Users and Customers plugin \<= 2.5.2 - Path Traversal vulnerability (CVSS 4.3)
- [CVE-2024-22288](https://cve.now/CVE-2024-22288.md): WordPress WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels plugin \<= 4.4.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2024-30231](https://cve.now/CVE-2024-30231.md): WordPress Product Import Export for WooCommerce plugin \<= 2.4.1 - Arbitrary File Upload vulnerability (CVSS 9.1)
- [CVE-2024-0957](https://cve.now/CVE-2024-0957.md): WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels \<= 4.4.1 - Unauthenticated Stored Cross-Site Scripting (CVSS 6.1)
- [CVE-2024-22135](https://cve.now/CVE-2024-22135.md): WordPress Order Export & Order Import for WooCommerce Plugin \<= 2.4.3 is vulnerable to Arbitrary File Upload (CVSS 8.0)
- [CVE-2024-22152](https://cve.now/CVE-2024-22152.md): WordPress Product Import Export for WooCommerce Plugin \<= 2.3.7 is vulnerable to Arbitrary File Upload (CVSS 8.0)
- [CVE-2023-6558](https://cve.now/CVE-2023-6558.md): Export and Import Users and Customers \<= 2.4.8 - Authenticated (Shop Manager+) Arbitrary File Upload (CVSS 7.2)
- [CVE-2023-7068](https://cve.now/CVE-2023-7068.md): WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels \<= 4.3.0 - Missing Authorization to Order Export (CVSS 4.3)
- [CVE-2023-48284](https://cve.now/CVE-2023-48284.md): WordPress Decorator – WooCommerce Email Customizer Plugin \<= 1.2.7 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3)
- [CVE-2022-45370](https://cve.now/CVE-2022-45370.md): WordPress WordPress Comments Import & Export Plugin \<= 2.3.1 is vulnerable to CSV Injection (CVSS 6.1)
- [CVE-2022-46802](https://cve.now/CVE-2022-46802.md): WordPress Product Reviews Import Export for WooCommerce Plugin \<= 1.4.8 is vulnerable to CSV Injection (CVSS 6.1)
- [CVE-2023-4040](https://cve.now/CVE-2023-4040.md): The Stripe Payment Plugin for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capabilit (CVSS 5.3)
- [CVE-2023-3459](https://cve.now/CVE-2023-3459.md): Export and Import Users and Customers \<= 2.4.1 - Missing Authorization to Authenticated (Shop Manager) Arbitrary User Password Change (CVSS 7.2)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/webtoffee
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.