Vulnerabilities

TI-2025-01658 CVE-2025-1913 · GHSA-8h4g-52x5-5r4v

Product Import Export for WooCommerce <= 2.5.0 - Authenticated (Admin+) PHP Object Injection via form_data Parameter

LOW 35

The Product Import Export for WooCommerce – Import Export Product CSV Suite plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.5.0 via deserialization of untrusted input fr…

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.00891 Published 2025-03-26 No fix listed CWE-502

TI-2025-01656 CVE-2025-1911 · GHSA-9m8m-6289-mfmf

Product Import Export for WooCommerce <= 2.5.0 - Directory Traversal to Authenticated…

LOW 29

The Product Import Export for WooCommerce – Import Export Product CSV Suite plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the admin_log_page() function in all v…

CVSS 3.1MEDIUM 6.5 Network High privileges No interaction EPSS 0.00426 Published 2025-03-26 No fix listed CWE-73

TI-2025-01657 CVE-2025-1912 · GHSA-79v6-3rr4-h2q4

Server-side request forgery in WebToffee Product Import Export for WooCommerce – Import…

LOW 33

The Product Import Export for WooCommerce – Import Export Product CSV Suite plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.5.0 via the validate_file() Function.

CVSS 3.1HIGH 7.6 Network High privileges No interaction EPSS 0.00382 Published 2025-03-26 No fix listed CWE-918

TI-2025-01524 CVE-2025-1769 · GHSA-7p7m-q926-gvc3

Path traversal in WebToffee Product Import Export for WooCommerce – Import Export Product…

LOW 24

The Product Import Export for WooCommerce – Import Export Product CSV Suite plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.5.0 via the download_file() function.

CVSS 3.1MEDIUM 4.9 Network High privileges No interaction EPSS 0.00807 Published 2025-03-26 No fix listed CWE-22

TI-2024-19977 CVE-2024-30231 · GHSA-8v7g-v34f-jv8p

WordPress Product Import Export for WooCommerce plugin <= 2.4.1 - Arbitrary File Upload vulnerability

MEDIUM 42

Unrestricted Upload of File with Dangerous Type vulnerability in WebToffee Product Import Export for WooCommerce.This issue affects Product Import Export for WooCommerce: from n/a through 2.4.1.

CVSS 3.1CRITICAL 9.1 Network High privileges No interaction EPSS 0.00603 Published 2024-03-26 No fix listed CWE-434

TI-2024-14753 CVE-2024-22152 · GHSA-wxc7-2q9f-mhvh

WordPress Product Import Export for WooCommerce Plugin <= 2.3.7 is vulnerable to Arbitrary File Upload

LOW 37

Unrestricted Upload of File with Dangerous Type vulnerability in WebToffee Product Import Export for WooCommerce.This issue affects Product Import Export for WooCommerce: from n/a through 2.3.7.

CVSS 3.1HIGH 8.0 Network High privileges No interaction EPSS 0.00525 Published 2024-01-24 No fix listed CWE-434