Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

8 records

Vendor: WebToffee Component: Import Export Wordpress Users Clear all filters
TI-2025-01718 CVE-2025-1973 · GHSA-29mm-6j7g-rc29

Path traversal in WebToffee Export and Import Users and Customers

Priority LOW 24

The Export and Import Users and Customers plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 2.6.2 via the download_file() function.

CVSS 3.1MEDIUM 4.9 Network High privileges No interaction EPSS 0.00748 Published 2025-03-22 No fix listed CWE-22
TI-2025-01715 CVE-2025-1970 · GHSA-wch2-934c-qj79

Server-side request forgery in WebToffee Export and Import Users and Customers

Priority LOW 34

The Export and Import Users and Customers plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.6.2 via the validate_file() function.

CVSS 3.1HIGH 7.6 Network High privileges No interaction EPSS 0.00418 Published 2025-03-22 No fix listed CWE-918
TI-2025-01716 CVE-2025-1971 · GHSA-37gg-wgcr-hmpr

Export and Import Users and Customers <= 2.6.2 - Authenticated (Admin+) PHP Object Injection via form_data Parameter

Priority LOW 35

The Export and Import Users and Customers plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.6.2 via deserialization of untrusted input from the 'form_data' parameter.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.00753 Published 2025-03-22 No fix listed CWE-502
TI-2025-01717 CVE-2025-1972 · GHSA-hjx4-8932-9cpq

Export and Import Users and Customers <= 2.6.2 - Directory Traversal to Authenticated…

Priority LOW 29

The Export and Import Users and Customers plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the admin_log_page() function in all versions up to, and including, 2.6.…

CVSS 3.1MEDIUM 6.5 Network High privileges No interaction EPSS 0.00402 Published 2025-03-22 No fix listed CWE-73
TI-2023-06009 CVE-2023-6558 · GHSA-r886-h68c-qmvr

Export and Import Users and Customers <= 2.4.8 - Authenticated (Shop Manager+) Arbitrary File Upload

Priority LOW 36

The Export and Import Users and Customers plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation on the 'upload_import_file' function in versions up to, and including, 2.4.8…

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.01366 Published 2024-01-11 No fix listed CWE-434
TI-2023-03231 CVE-2023-3459 · GHSA-6x4f-h7g4-fcw2

Incorrect authorization in WebToffee Export and Import Users and Customers

Priority LOW 35

The Export and Import Users and Customers plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'hf_update_customer' function called via an AJAX action in versio…

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.0093 Published 2023-07-18 No fix listed CWE-863
TI-2019-11270 CVE-2019-15092 · GHSA-3gp8-m4q9-qx42

The webtoffee "WordPress Users & WooCommerce Customers Import Export" plugin 1.3.0 for…

Priority MEDIUM 40

The webtoffee "WordPress Users & WooCommerce Customers Import Export" plugin 1.3.0 for WordPress allows CSV injection in the user_url, display_name, first_name, and last_name columns in an exported CSV file created by th…

CVSS 3.0HIGH 7.3 Local Low privileges User interaction EPSS 0.05141 Published 2019-08-23 No fix listed CWE-1236