WebToffee vulnerabilities
We track 22 vulnerabilities in WebToffee products across 17 products. 22 are rated high or critical, and none are known to be exploited. The most recent was published on October 30, 2026.
Latest WebToffee vulnerabilities
- 8.8 High severity
Export and Import Users and Customers: Improper Encoding or Escaping of Output
The Export and Import Users and Customers plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.7.5 via the plugin's own export and re-import workflow. The vulnerability exists because of a CSV escape-character mism
- 7.5 High severity
WebToffee WooCommerce PDF Invoices, Packing…: Authorization Bypass Through User-Controlled Key
The WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 5.0.2 via the 'email' parameter of the guest print_document_from_th
- 7.5 High severity
Smart Coupons for WooCommerce: Missing Authorization
Missing Authorization vulnerability in WebToffee Smart Coupons for WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Smart Coupons for WooCommerce: from n/a before 2.3.0.
- 7.7 High severity
Comments Import & Export: Missing Authorization
Missing Authorization vulnerability in WebToffee Comments Import & Export comments-import-export-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Comments Import & Export: from n/a through <= 2.4.9.
- 7.2 High severity
Product Feed for WooCommerce: Deserialization of Untrusted Data
Deserialization of Untrusted Data vulnerability in WebToffee Product Feed for WooCommerce webtoffee-product-feed allows Object Injection.This issue affects Product Feed for WooCommerce: from n/a through <= 2.3.3.
- 7.2 High severity
Product Import Export for WooCommerce – Import…: Deserialization of Untrusted Data
The Product Import Export for WooCommerce – Import Export Product CSV Suite plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.5.0 via deserialization of untrusted input from the 'form_data' parameter This makes
- 7.6 High severity
Product Import Export for WooCommerce – Import…: Server-Side Request Forgery
The Product Import Export for WooCommerce – Import Export Product CSV Suite plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.5.0 via the validate_file() Function. This makes it possible for authenticated
- 7.2 High severity
Export and Import Users and Customers: Deserialization of Untrusted Data
The Export and Import Users and Customers plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.6.2 via deserialization of untrusted input from the 'form_data' parameter. This makes it possible for authenticated att
- 7.6 High severity
Export and Import Users and Customers: Server-Side Request Forgery
The Export and Import Users and Customers plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.6.2 via the validate_file() function. This makes it possible for authenticated attackers, with Administrator-lev
- 7.2 High severity
Order Export & Order Import for WooCommerce: Deserialization of Untrusted Data
The Order Export & Order Import for WooCommerce plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.6.0 via deserialization of untrusted input from the 'form_data' parameter. This makes it possible for authenticat
- 7.2 High severity
WooCommerce PDF Invoices, Packing Slips…: Improper Privilege Management
Improper Privilege Management vulnerability in WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels allows Privilege Escalation.This issue affects WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels: fro
- 7.5 High severity
WordPress Backup & Migration: Insertion of Sensitive Information into Log File
Insertion of Sensitive Information into Log File vulnerability in WebToffee WordPress Backup & Migration.This issue affects WordPress Backup & Migration: from n/a through 1.4.7.
- 7.2 High severity
Product Import Export for WooCommerce: Unrestricted Upload of File with Dangerous Type
Unrestricted Upload of File with Dangerous Type vulnerability in WebToffee Product Import Export for WooCommerce.This issue affects Product Import Export for WooCommerce: from n/a through 2.4.1.
- 7.2 High severity
Product Import Export for WooCommerce: Unrestricted Upload of File with Dangerous Type
Unrestricted Upload of File with Dangerous Type vulnerability in WebToffee Product Import Export for WooCommerce.This issue affects Product Import Export for WooCommerce: from n/a through 2.3.7.
- 7.2 High severity
Order Export & Order Import for WooCommerce: Unrestricted Upload of File with Dangerous Type
Unrestricted Upload of File with Dangerous Type vulnerability in WebToffee Order Export & Order Import for WooCommerce.This issue affects Order Export & Order Import for WooCommerce: from n/a through 2.4.3.
- 7.5 High severity
Payment Gateway of Stripe for WooCommerce: Improper Neutralization of Special Elements used in an SQL Command
The Stripe Payment Plugin for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the 'id' parameter in all versions up to, and including, 3.7.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on t
- 7.2 High severity
Export and Import Users and Customers: Unrestricted Upload of File with Dangerous Type
The Export and Import Users and Customers plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation on the 'upload_import_file' function in versions up to, and including, 2.4.8. This makes it possible for authenticat
- 8.8 High severity
Decorator – WooCommerce Email Customizer: Cross-Site Request Forgery
Cross-Site Request Forgery (CSRF) vulnerability in WebToffee Decorator – WooCommerce Email Customizer allows Cross Site Request Forgery.This issue affects Decorator – WooCommerce Email Customizer: from n/a through 1.2.7.
- 9.8 Critical severity
WordPress Comments Import & Export: Improper Neutralization of Formula Elements in a CSV File
Improper Neutralization of Formula Elements in a CSV File vulnerability in WebToffee WordPress Comments Import & Export.This issue affects WordPress Comments Import & Export: from n/a through 2.3.1.
- 9.8 Critical severity
Product Reviews Import Export for WooCommerce: Improper Neutralization of Formula Elements in a CSV File
Improper Neutralization of Formula Elements in a CSV File vulnerability in WebToffee Product Reviews Import Export for WooCommerce.This issue affects Product Reviews Import Export for WooCommerce: from n/a through 1.4.8.
- 9.8 Critical severity
Payment Gateway of Stripe for WooCommerce: Authentication Bypass Using an Alternate Path or Channel
The Stripe Payment Plugin for WooCommerce plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 3.7.7. This is due to insufficient verification on the user being supplied during a Stripe checkout through the plugin. This
- 7.2 High severity
Export and Import Users and Customers: Incorrect Authorization
The Export and Import Users and Customers plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'hf_update_customer' function called via an AJAX action in versions up to, and including, 2.4.1. This mak