WebToffee has 3 CVEs on record. 3 were published in the last 90 days. The median CVSS is 7.5 (high).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 7.5
- Publish → KEV
- —
- Last 90 days
- 3 prev 0
Products
- Order Export & Order Import for WooCommerce 1
- WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels 1
- wp-migration-duplicator 1
Worst active — by depth score
CVE-2026-93746High· 7.5The WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 5.0.2 via the 'email' parameter of the guest…41CVE-2026-97197High· 7.5Unauthenticated Broken Access Control in WordPress Backup & Migration <= 1.6.0 versions.41CVE-2026-94375Medium· 5.3The Order Export & Order Import for WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.7.8 via the get_file_path29
WebToffee vulnerabilities
CVEs affecting WebToffee, newest first. Open any entry for full detail, references, and exploit status.
3 CVEsRSS
CVE-2026-93746High· 7.5The WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 5.0.2 via the 'email' parameter of the guest…
The WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 5.0.2 via the 'email' parameter of the guest…
CVE-2026-94375Medium· 5.3The Order Export & Order Import for WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.7.8 via the get_file_path
The Order Export & Order Import for WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.7.8 via the get_file_path. This makes it possible for unauthenticated attackers …
CVE-2026-97197High· 7.5Unauthenticated Broken Access Control in WordPress Backup & Migration <= 1.6.0 versions.
Unauthenticated Broken Access Control in WordPress Backup & Migration <= 1.6.0 versions.