Log in Start free

WebToffee

Products

ProductCVEsExploitedLatest
Order Export & Order Import for WooCommerce8–Oct 10, 2026
Export and Import Users and Customers7–Oct 30, 2026
WordPress Backup & Migration6–Sep 30, 2026
WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels5–Oct 10, 2026
Product Import Export for WooCommerce4–Oct 29, 2026
WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels4–Jun 15, 2026
Product Import Export for WooCommerce – Import Export Product CSV Suite4–Mar 26, 2025
Comments Import & Export3–Mar 25, 2026
Product Feed for WooCommerce3–Mar 25, 2026
Import Export WordPress Users2–Apr 24, 2024
WordPress Comments Import & Export2–Apr 12, 2024
Smart Coupons for WooCommerce2–May 25, 2026
Product Reviews Import Export for WooCommerce1–Nov 7, 2023
Alt Text Generator AI – Auto Generate & Bulk Update Alt Texts For Images1–Nov 12, 2025
Decorator – WooCommerce Email Customizer1–Nov 30, 2023
Accessibility Toolkit by WebYes1–Nov 21, 2025
Stripe Payment Plugin for WooCommerce1–Aug 18, 2023
WebToffee eCommerce Marketing Automation1–Dec 9, 2025
WebToffee WP Backup and Migration1–May 2, 2024
Wishlist for WooCommerce1–Jan 24, 2025
WooCommerce Shipping Label1–Apr 24, 2024

Exploited and recent CVEs

  • CVE-2026-104368 High 8.8 Export and Import Users and Customers <= 2.7.5 - Authenticated (Subscriber+) Privilege Escalation via CSV Escape-Character Mismatch in Export/Import Round Trip via Biographical Info Field 0.3%
  • CVE-2026-118989 Medium 5.5 WebToffee Product Import Export for WooCommerce 2.5.1 before 2.6.8 SSRF via Redirects 0.3%
  • CVE-2026-93746 High 7.5 WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels <= 5.0.2 - Insecure Direct Object Reference to Unauthenticated Unauthorized Order Document Access via 'email' Parameter 0.5%
  • CVE-2026-94375 Medium 5.3 Order Export & Order Import for WooCommerce <= 2.7.8 - Unauthenticated Sensitive File Exposure via Missing Directory Guard Re-verification in get_file_path() 0.3%
  • CVE-2026-97197 High 7.5 WordPress WordPress Backup & Migration plugin <= 1.6.0 - Broken Access Control vulnerability 0.3%
  • CVE-2026-18027 Medium 6.5 WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels <= 4.9.8 - Authenticated (Subscriber+) Arbitrary File Read via 'customer_note' Parameter 0.9%
  • CVE-2026-49056 High 7.5 WordPress WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels plugin <= 4.9.4 - Sensitive Data Exposure vulnerability 0.4%
  • CVE-2026-48971 Medium 4.3 WordPress Product Import Export for WooCommerce plugin <= 2.5.6 - Broken Access Control vulnerability 0.2%
  • CVE-2026-45438 High 7.5 WordPress Smart Coupons for WooCommerce plugin < 2.3.0 - Broken Access Control vulnerability 0.3%
  • CVE-2026-32441 High 7.7 WordPress Comments Import & Export plugin <= 2.4.9 - Broken Access Control vulnerability 0.3%
  • CVE-2026-22480 High 7.2 WordPress Product Feed for WooCommerce plugin <= 2.3.3 - PHP Object Injection vulnerability 0.5%
  • CVE-2025-67599 Medium 4.3 WordPress WebToffee eCommerce Marketing Automation plugin <= 2.1.1 - Broken Access Control vulnerability 0.2%
  • CVE-2025-66112 Medium 4.3 WordPress Accessibility Toolkit by WebYes plugin <= 2.0.4 - Broken Access Control vulnerability 0.2%
  • CVE-2025-66089 Medium 4.3 WordPress Product Feed for WooCommerce plugin <= 2.3.1 - Broken Access Control vulnerability 0.2%
  • CVE-2025-64382 Medium 4.3 WordPress Order Export & Order Import for WooCommerce plugin <= 2.6.7 - Broken Access Control vulnerability 0.2%
  • CVE-2025-12113 Medium 4.3 Alt Text Generator AI – Auto Generate & Bulk Update Alt Texts For Images <= 1.8.3 - Missing Authorization to Authenticated (Subscriber+) API Key Deletion 0.2%
  • CVE-2025-64358 Medium 4.3 WordPress Smart Coupons for WooCommerce plugin <= 2.2.3 - Broken Access Control vulnerability 0.2%
  • CVE-2025-49287 Medium 4.3 WordPress Product Feed for WooCommerce plugin <= 2.2.8 - Broken Access Control Vulnerability 0.3%
  • CVE-2025-3919 Medium 6.4 WordPress Comments Import & Export <= 2.4.3 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting 0.3%
  • CVE-2025-24651 Medium 5.9 WordPress WebToffee WP Backup and Migration plugin <= 1.5.3 - Sensitive Data Exposure vulnerability 0.4%
  • CVE-2025-1913 High 7.2 Product Import Export for WooCommerce <= 2.5.0 - Authenticated (Admin+) PHP Object Injection via form_data Parameter 0.9%
  • CVE-2025-1911 Low 2.7 Product Import Export for WooCommerce <= 2.5.0 - Directory Traversal to Authenticated (Administrator+) Limited Arbitrary File Deletion via admin_log_page Function 0.4%
  • CVE-2025-1912 High 7.6 Product Import Export for WooCommerce <= 2.5.0 - Authenticated (Administrator+) Server-Side Request Forgery via validate_file Function 0.4%
  • CVE-2025-1769 Medium 4.9 Product Import Export for WooCommerce <= 2.5.0 - Directory Traversal to Authenticated (Administrator+) Limited Arbitrary File Read via download_file Function 0.8%
  • CVE-2025-1973 Medium 4.9 Export and Import Users and Customers <= 2.6.2 - Directory Traversal to Authenticated (Administrator+) Limited Arbitrary File Read via download_file Function 0.7%
  • CVE-2025-1970 High 7.6 Export and Import Users and Customers <= 2.6.2 - Authenticated (Administrator+) Server-Side Request Forgery via validate_file Function 0.4%
  • CVE-2025-1971 High 7.2 Export and Import Users and Customers <= 2.6.2 - Authenticated (Admin+) PHP Object Injection via form_data Parameter 0.8%
  • CVE-2025-1972 Low 2.7 Export and Import Users and Customers <= 2.6.2 - Directory Traversal to Authenticated (Administrator+) Limited Arbitrary File Deletion via admin_log_page Function 0.4%
  • CVE-2024-13920 Medium 4.9 Order Export & Order Import for WooCommerce <= 2.6.0 - Directory Traversal to Authenticated (Administrator+) Limited Arbitrary File Read via download_file Function 0.8%
  • CVE-2024-13921 High 7.2 Order Export & Order Import for WooCommerce <= 2.6.0 - Authenticated (Admin+) PHP Object Injection via form_data Parameter 0.7%