Vulnerabilities in webtoffee

60 results
CVE-2026-104368HIGHExport and Import Users and Customers <= 2.7.5 - Authenticated (Subscriber+) Privilege Escalation via CSV Escape-Character Mismatch in Export/Import Round Trip via Biographical Info FieldEPSS 0.3%CVE-2024-32834MEDIUMWordPress WooCommerce Shipping Label plugin <= 2.3.8 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-49287MEDIUMWordPress Product Feed for WooCommerce plugin <= 2.2.8 - Broken Access Control VulnerabilityEPSS 0.3%CVE-2023-48284MEDIUMWordPress Decorator – WooCommerce Email Customizer Plugin <= 1.2.7 is vulnerable to Cross Site Request Forgery (CSRF)EPSS 0.3%CVE-2025-3919MEDIUMWordPress Comments Import & Export <= 2.4.3 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2026-45438HIGHWordPress Smart Coupons for WooCommerce plugin < 2.3.0 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2026-94375MEDIUMOrder Export & Order Import for WooCommerce <= 2.7.8 - Unauthenticated Sensitive File Exposure via Missing Directory Guard Re-verification in get_file_path()EPSS 0.3%CVE-2026-97197HIGHWordPress WordPress Backup & Migration plugin <= 1.6.0 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2026-32441HIGHWordPress Comments Import & Export plugin <= 2.4.9 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2026-118989MEDIUMWebToffee Product Import Export for WooCommerce 2.5.1 before 2.6.8 SSRF via RedirectsEPSS 0.3%CVE-2024-34751MEDIUMWordPress Order Export & Order Import for WooCommerce plugin <= 2.4.9 - PHP Object Injection vulnerabilityEPSS 0.2%CVE-2026-120530MEDIUMWebToffee WP Backup and Migration <= 1.6.1 - Authenticated (Subscriber+) SQL Injection via User Profile BiographyEPSS 0.2%CVE-2026-48971MEDIUMWordPress Product Import Export for WooCommerce plugin <= 2.5.6 - Broken Access Control vulnerabilityEPSS 0.2%CVE-2024-31235MEDIUMWordPress Comments Import & Export plugin <= 2.3.5 - Cross Site Request Forgery (CSRF) vulnerabilityEPSS 0.2%CVE-2025-67599MEDIUMWordPress WebToffee eCommerce Marketing Automation plugin <= 2.1.1 - Broken Access Control vulnerabilityEPSS 0.2%CVE-2025-66112MEDIUMWordPress Accessibility Toolkit by WebYes plugin <= 2.0.4 - Broken Access Control vulnerabilityEPSS 0.2%CVE-2025-64382MEDIUMWordPress Order Export & Order Import for WooCommerce plugin <= 2.6.7 - Broken Access Control vulnerabilityEPSS 0.2%CVE-2025-64358MEDIUMWordPress Smart Coupons for WooCommerce plugin <= 2.2.3 - Broken Access Control vulnerabilityEPSS 0.2%CVE-2025-66089MEDIUMWordPress Product Feed for WooCommerce plugin <= 2.3.1 - Broken Access Control vulnerabilityEPSS 0.2%CVE-2025-12113MEDIUMAlt Text Generator AI – Auto Generate & Bulk Update Alt Texts For Images <= 1.8.3 - Missing Authorization to Authenticated (Subscriber+) API Key DeletionEPSS 0.2%