PatchTheCVEwebtoffee vulnerabilities
Recent CVEs affecting webtoffee products. 15 tracked.
webtoffee has 15 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 15. Most recent: 2025-05-15. Highest priority: CVE-2025-1913 (score 40/100).
- CVE-2025-24644 MEDIUM 5.9 UPGRADE Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WebToffe
- CVE-2025-1973 MEDIUM 4.9 UPGRADE The Export and Import Users and Customers plugin for WordPress is vulnerable to Path Traversal in all versions
- CVE-2025-1972 LOW 2.7 UPGRADE The Export and Import Users and Customers plugin for WordPress is vulnerable to arbitrary file deletion due to
- CVE-2025-1971 HIGH 7.2 UPGRADE The Export and Import Users and Customers plugin for WordPress is vulnerable to PHP Object Injection in all ve
- CVE-2025-1970 HIGH 7.6 UPGRADE The Export and Import Users and Customers plugin for WordPress is vulnerable to Server-Side Request Forgery in
- CVE-2025-1913 HIGH 7.2 UPGRADE The Product Import Export for WooCommerce – Import Export Product CSV Suite plugin for WordPress is vulnerable
- CVE-2025-1912 HIGH 7.6 UPGRADE The Product Import Export for WooCommerce – Import Export Product CSV Suite plugin for WordPress is vulnerable
- CVE-2025-1911 LOW 2.7 UPGRADE The Product Import Export for WooCommerce – Import Export Product CSV Suite plugin for WordPress is vulnerable
- CVE-2025-1769 MEDIUM 4.9 UPGRADE The Product Import Export for WooCommerce – Import Export Product CSV Suite plugin for WordPress is vulnerable
- CVE-2024-8397 MEDIUM 5.4 UPGRADE The webtoffee-gdpr-cookie-consent WordPress plugin before 2.6.1 does not properly sanitize and escape the IP h
- CVE-2024-8286 MEDIUM 6.5 UPGRADE The webtoffee-gdpr-cookie-consent WordPress plugin before 2.6.1 does not have CSRF checks in some bulk actions
- CVE-2024-13923 HIGH 7.6 UPGRADE The Order Export & Order Import for WooCommerce plugin for WordPress is vulnerable to Server-Side Request Forg
- CVE-2024-13922 LOW 2.7 UPGRADE The Order Export & Order Import for WooCommerce plugin for WordPress is vulnerable to arbitrary file deletion
- CVE-2024-13921 HIGH 7.2 UPGRADE The Order Export & Order Import for WooCommerce plugin for WordPress is vulnerable to PHP Object Injection in
- CVE-2024-13920 MEDIUM 4.9 UPGRADE The Order Export & Order Import for WooCommerce plugin for WordPress is vulnerable to Directory Traversal in a
FAQ
How do I fix webtoffee vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is webtoffee being exploited right now?
None of the tracked webtoffee CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which webtoffee CVE should I patch first?
CVE-2025-1913 currently ranks highest (40/100): The Product Import Export for WooCommerce – Import Export Product CSV Suite plugin for WordPress is vulnerable.