CVE Tools
Track your stack

Webtoffee

27 CVEs tracked since 2023. Since Nov 2023, none of them reached CISA KEV.

Webtoffee CVEs per month

Nov 2023 to Oct 2026. Point at a month, or focus the strip and use the arrow keys.
Webtoffee CVEs per month, with the share now in CISA KEV
MonthCVEsIn CISA KEV
2023-1150
2023-124 or fewer
2024-0150
2024-024 or fewer
2024-034 or fewer
2024-0450
2024-055 or fewer
2024-064 or fewer
2024-074 or fewer
2024-084 or fewer
2024-093 or fewer
2024-104 or fewer
2024-114 or fewer
2024-123 or fewer
2025-014 or fewer
2025-023 or fewer
2025-03120
2025-044 or fewer
2025-054 or fewer
2025-064 or fewer
2025-075 or fewer
2025-084 or fewer
2025-094 or fewer
2025-104 or fewer
2025-114 or fewer
2025-125 or fewer
2026-015 or fewer
2026-025 or fewer
2026-037 or fewer
2026-046 or fewer
2026-057 or fewer
2026-067 or fewer
2026-077 or fewer
2026-088 or fewer
2026-099 or fewer
2026-106 or fewer

Products

The products that kept showing up in Webtoffee's monthly top three, with their CVEs summed over those months.

  1. Import Export WordPress Users63 months
  2. Export and Import Users and Customers52 months
  3. Order Export & Order Import For Woocommerce52 months
  4. Backup and Migration32 months
  5. Decorator11 month
  6. Decorator – Woocommerce Email Customizer11 month
  7. Webtoffee Woocommerce Pdf Invoices, Packing Slips, Delivery Notes & Shipping Labels11 month

Latest CVEs

The 15 most recently published vulnerabilities affecting Webtoffee.

  1. CVE-2026-93746WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels <= 5.0.2 - Insecure Direct Object Reference to Unauthenticated Unauthorized Order Document Access via 'email' Parameter7.5
  2. CVE-2026-94375Order Export & Order Import for WooCommerce <= 2.7.8 - Unauthenticated Sensitive File Exposure via Missing Directory Guard Re-verification in get_file_path()5.3
  3. CVE-2026-97197WordPress WordPress Backup & Migration plugin <= 1.6.0 - Broken Access Control vulnerability7.5
  4. CVE-2026-18027WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels <= 4.9.8 - Authenticated (Subscriber+) Arbitrary File Read via 'customer_note' Parameter6.5
  5. CVE-2026-49056WordPress WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels plugin <= 4.9.4 - Sensitive Data Exposure vulnerability7.5
  6. CVE-2026-48971WordPress Product Import Export for WooCommerce plugin <= 2.5.6 - Broken Access Control vulnerability4.3
  7. CVE-2026-45438WordPress Smart Coupons for WooCommerce plugin < 2.3.0 - Broken Access Control vulnerability7.5
  8. CVE-2026-32441WordPress Comments Import & Export plugin <= 2.4.9 - Broken Access Control vulnerability7.7
  9. CVE-2026-22480WordPress Product Feed for WooCommerce plugin <= 2.3.3 - PHP Object Injection vulnerability7.2
  10. CVE-2025-67599WordPress WebToffee eCommerce Marketing Automation plugin <= 2.1.1 - Broken Access Control vulnerability4.3
  11. CVE-2025-66112WordPress Accessibility Toolkit by WebYes plugin <= 2.0.4 - Broken Access Control vulnerability4.3
  12. CVE-2025-66089WordPress Product Feed for WooCommerce plugin <= 2.3.1 - Broken Access Control vulnerability4.3
  13. CVE-2025-64382WordPress Order Export & Order Import for WooCommerce plugin <= 2.6.7 - Broken Access Control vulnerability4.3
  14. CVE-2025-12113Alt Text Generator AI – Auto Generate & Bulk Update Alt Texts For Images <= 1.8.3 - Missing Authorization to Authenticated (Subscriber+) API Key Deletion4.3
  15. CVE-2025-64358WordPress Smart Coupons for WooCommerce plugin <= 2.2.3 - Broken Access Control vulnerability4.3

The record

Peak rank
#84 in Mar 2025
Busiest month shown
Mar 2025, 12 CVEs
Months with a KEV entry
0 since Nov 2023
Monthly snapshots
4 since 2023
Webtoffee's full record, month by month