Read the docs

WebToffee

Records69All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical5CVSS 9.0–10.0
CVSS high24CVSS 7.0–8.9

Exploited now

WebToffee records in CISA KEV

No WebToffee vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Import Export Wordpress Users 8 records MEDIUM Product Import Export For Woocommerce 6 records MEDIUM Woocommerce Pdf Invoices, Packing Slips, Delivery Notes And Shipping Labels 6 records LOW Order Export & Order Import For Woocommerce 5 records LOW Backup And Migration 3 records LOW Stripe Payment Plugin For Woocommerce 3 records MEDIUM Gdpr Cookie Consent 2 records MEDIUM Wordpress Comments Import And Export 2 records MEDIUM

Records

2 records in Gdpr Cookie Consent · all components

TI-2024-07682 CVE-2024-8286 · GHSA-6925-xwwp-qwh5

GDPR Cookie Consent <= 2.6.0 - Bulk Delete via CSRF

Priority MEDIUM 62

The webtoffee-gdpr-cookie-consent WordPress plugin before 2.6.1 does not have CSRF checks in some bulk actions, which could allow attackers to make logged in admins perform unwanted actions, such as deleting visit logs v…

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.00213 Published 2025-05-15 Fixed in 2.6.1 CWE-352
TI-2024-07785 CVE-2024-8397 · GHSA-j4qf-29vf-7xcj

GDPR Cookie Consent <= 2.6.0 - Unauthenticated Stored XSS

Priority MEDIUM 58

The webtoffee-gdpr-cookie-consent WordPress plugin before 2.6.1 does not properly sanitize and escape the IP headers when logging them, allowing visitors to conduct Stored Cross-Site Scripting attacks.

CVSS 3.1MEDIUM 5.4 Network No auth User interaction EPSS 0.00326 Published 2025-05-15 Fixed in 2.6.1 CWE-79
Open these records in search →