WebToffee vulnerabilities

CVEs per yearBy the year they were published

1. 20235
2. 202419
3. 202524
4. 202611

Newest CVEs

• CVE-2026-104368

  Export and Import Users and Customers <= 2.7.5 - Authenticated (Subscriber+) Privilege Escalation via CSV Escape-Character Mismatch in Export/Import Round Trip via Biographical Info Field

  webtoffee · Export and Import Users and Customers

  High8.8
• CVE-2026-118989

  WebToffee Product Import Export for WooCommerce 2.5.1 before 2.6.8 SSRF via Redirects

  WebToffee · Product Import Export for WooCommerce

  Medium5.1
• CVE-2026-93746

  WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels <= 5.0.2 - Insecure Direct Object Reference to Unauthenticated Unauthorized Order Document Access via 'email' Parameter

  webtoffee · WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels

  High7.5
• CVE-2026-94375

  Order Export & Order Import for WooCommerce <= 2.7.8 - Unauthenticated Sensitive File Exposure via Missing Directory Guard Re-verification in get_file_path()

  webtoffee · Order Export & Order Import for WooCommerce

  Medium5.3
• CVE-2026-97197

  WordPress WordPress Backup & Migration plugin <= 1.6.0 - Broken Access Control vulnerability

  WebToffee · WordPress Backup & Migration

  High7.5
• CVE-2026-18027

  WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels <= 4.9.8 - Authenticated (Subscriber+) Arbitrary File Read via 'customer_note' Parameter

  webtoffee · WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels

  Medium6.5
• CVE-2026-49056

  WordPress WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels plugin <= 4.9.4 - Sensitive Data Exposure vulnerability

  WebToffee · WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels

  High7.5
• CVE-2026-48971

  WordPress Product Import Export for WooCommerce plugin <= 2.5.6 - Broken Access Control vulnerability

  WebToffee · Product Import Export for WooCommerce

  Medium4.3
• CVE-2026-45438

  WordPress Smart Coupons for WooCommerce plugin < 2.3.0 - Broken Access Control vulnerability

  WebToffee · Smart Coupons for WooCommerce

  High7.5
• CVE-2026-32441

  WordPress Comments Import & Export plugin <= 2.4.9 - Broken Access Control vulnerability

  WebToffee · Comments Import & Export

  High7.7