Read the docs

WebToffee

Records69All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical5CVSS 9.0–10.0
CVSS high24CVSS 7.0–8.9

Exploited now

WebToffee records in CISA KEV

No WebToffee vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Import Export Wordpress Users 8 records MEDIUM Product Import Export For Woocommerce 6 records MEDIUM Woocommerce Pdf Invoices, Packing Slips, Delivery Notes And Shipping Labels 6 records LOW Order Export & Order Import For Woocommerce 5 records LOW Backup And Migration 3 records LOW Stripe Payment Plugin For Woocommerce 3 records MEDIUM Gdpr Cookie Consent 2 records MEDIUM Wordpress Comments Import And Export 2 records MEDIUM

Records

5 records in Order Export & Order Import For Woocommerce · all components

TI-2024-14736 CVE-2024-22135 · GHSA-6gfm-3jj5-pmhh

WordPress Order Export & Order Import for WooCommerce Plugin <= 2.4.3 is vulnerable to Arbitrary File Upload

Priority LOW 37

Unrestricted Upload of File with Dangerous Type vulnerability in WebToffee Order Export & Order Import for WooCommerce.This issue affects Order Export & Order Import for WooCommerce: from n/a through 2.4.3.

CVSS 3.1HIGH 8.0 Network High privileges No interaction EPSS 0.00525 Published 2024-01-24 No fix listed CWE-434
TI-2024-12940 CVE-2024-13921 · GHSA-g9c4-qhpw-x7pw

Deserialization of untrusted data in WebToffee Order Export & Order Import for WooCommerce

Priority LOW 35

The Order Export & Order Import for WooCommerce plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.6.0 via deserialization of untrusted input from the 'form_data' parameter…

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.00708 Published 2025-03-20 No fix listed CWE-502
TI-2024-12941 CVE-2024-13922 · GHSA-jrhv-8gfh-55w6

Order Export & Order Import for WooCommerce <= 2.6.0 - Directory Traversal to…

Priority LOW 29

The Order Export & Order Import for WooCommerce plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the admin_log_page() function in all versions up to, and including…

CVSS 3.1MEDIUM 6.5 Network High privileges No interaction EPSS 0.00401 Published 2025-03-20 No fix listed CWE-73
TI-2024-12939 CVE-2024-13920 · GHSA-749v-xf6w-5wcx

Path traversal in WebToffee Order Export & Order Import for WooCommerce

Priority LOW 24

The Order Export & Order Import for WooCommerce plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.6.0 via the download_file() function.

CVSS 3.1MEDIUM 4.9 Network High privileges No interaction EPSS 0.0076 Published 2025-03-20 No fix listed CWE-22
Open these records in search →