Read the docs

WebToffee

Records69All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical5CVSS 9.0–10.0
CVSS high24CVSS 7.0–8.9

Exploited now

WebToffee records in CISA KEV

No WebToffee vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Import Export Wordpress Users 8 records MEDIUM Product Import Export For Woocommerce 6 records MEDIUM Woocommerce Pdf Invoices, Packing Slips, Delivery Notes And Shipping Labels 6 records LOW Order Export & Order Import For Woocommerce 5 records LOW Backup And Migration 3 records LOW Stripe Payment Plugin For Woocommerce 3 records MEDIUM Gdpr Cookie Consent 2 records MEDIUM Wordpress Comments Import And Export 2 records MEDIUM

Records

3 records in Backup And Migration · all components

TI-2023-05277 CVE-2023-5738 · GHSA-mgqv-g9mm-hg88

WordPress Backup & Migration < 1.4.5 - Subscriber+ Stored XSS

Priority LOW 25

The WordPress Backup & Migration WordPress plugin before 1.4.4 does not sanitise and escape some parameters, which could allow users with a role as low as Subscriber to perform Cross-Site Scripting attacks.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00426 Published 2023-11-27 Fixed in 1.4.4 CWE-79
TI-2023-05276 CVE-2023-5737 · GHSA-px94-47v9-w45x

WordPress Backup & Migration < 1.4.4 - Subscriber+ Plugin Settings Update

Priority LOW 20

The WordPress Backup & Migration WordPress plugin before 1.4.4 does not authorize some AJAX requests, allowing users with a role as low as Subscriber to update some plugin settings.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00454 Published 2023-11-27 Fixed in 1.4.4 CWE-862
Open these records in search →