Webtoffee vulnerabilities
60 CVEs and advisories name Webtoffee as an affected vendor, newest first. Follow it as a feed.
- CVE-2024-13921Order Export & Order Import for WooCommerce <= 2.6.0 - Authenticated (Admin+) PHP Object Injection via form_data Parameter
- CVE-2024-13922Order Export & Order Import for WooCommerce <= 2.6.0 - Directory Traversal to Authenticated (Administrator+) Limited Arbitrary File Deletion via admin_log_page Function
- CVE-2024-13923Order Export & Order Import for WooCommerce <= 2.6.0 - Authenticated (Administrator+) Server-Side Request Forgery via validate_file Function
- CVE-2025-24657WordPress Wishlist for WooCommerce plugin <=2.1.2 - Cross Site Scripting (XSS) vulnerability
- CVE-2025-24644WordPress WooCommerce PDF Invoices plugin <= 4.7.1 - Stored Cross Site Scripting (XSS) vulnerability
- CVE-2023-45636WordPress Backup & Migration plugin <= 1.4.1 - Broken Access Control vulnerability
- CVE-2023-33928WordPress WordPress Backup & Migration plugin <= 1.4.0 - Broken Access Control vulnerability
- CVE-2024-7514WordPress Comments Import & Export <= 2.3.7 - Authenticated (Author+) Arbitrary File Read via Directory Traversal
- CVE-2023-52183WordPress WordPress Backup & Migration plugin <= 1.4.3 - Broken Access Control vulnerability
- CVE-2023-51546WordPress WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels plugin <= 4.2.1 - Privilege Escalation vulnerability
- CVE-2024-34751WordPress Order Export & Order Import for WooCommerce plugin <= 2.4.9 - PHP Object Injection vulnerability
- CVE-2024-3546WordPress Backup & Migration <= 1.4.8 - Missing Authorization to Directory Traversal
- CVE-2024-32834WordPress WooCommerce Shipping Label plugin <= 2.3.8 - Cross Site Scripting (XSS) vulnerability
- CVE-2024-32835WordPress Export and Import Users and Customers plugin <= 2.5.3 - Deserialization of untrusted data vulnerability
- CVE-2024-31235WordPress Comments Import & Export plugin <= 2.3.5 - Cross Site Request Forgery (CSRF) vulnerability
- CVE-2024-31254WordPress WordPress Backup & Migration plugin <= 1.4.7 - Sensitive Data Exposure via Log File vulnerability
- CVE-2024-3216WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels <= 4.4.2 - Missing Authorization to Unauthenticated Settings Reset
- CVE-2024-30492WordPress Export and Import Users and Customers plugin <= 2.5.2 - Path Traversal vulnerability
- CVE-2024-22288WordPress WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels plugin <= 4.4.0 - Reflected Cross Site Scripting (XSS) vulnerability
- CVE-2024-30231WordPress Product Import Export for WooCommerce plugin <= 2.4.1 - Arbitrary File Upload vulnerability
- CVE-2024-0957WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels <= 4.4.1 - Unauthenticated Stored Cross-Site Scripting
- CVE-2024-22135WordPress Order Export & Order Import for WooCommerce Plugin <= 2.4.3 is vulnerable to Arbitrary File Upload
- CVE-2024-22152WordPress Product Import Export for WooCommerce Plugin <= 2.3.7 is vulnerable to Arbitrary File Upload
- CVE-2023-6558Export and Import Users and Customers <= 2.4.8 - Authenticated (Shop Manager+) Arbitrary File Upload
- CVE-2023-7068WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels <= 4.3.0 - Missing Authorization to Order Export
- CVE-2023-48284WordPress Decorator – WooCommerce Email Customizer Plugin <= 1.2.7 is vulnerable to Cross Site Request Forgery (CSRF)
- CVE-2022-45370WordPress WordPress Comments Import & Export Plugin <= 2.3.1 is vulnerable to CSV Injection
- CVE-2022-46802WordPress Product Reviews Import Export for WooCommerce Plugin <= 1.4.8 is vulnerable to CSV Injection
- CVE-2023-4040The Stripe Payment Plugin for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capabilit
- CVE-2023-3459Export and Import Users and Customers <= 2.4.1 - Missing Authorization to Authenticated (Shop Manager) Arbitrary User Password Change