CVE-2026-118989

WebToffee Product Import Export for WooCommerce 2.5.1 before 2.6.8 contains a server-side request forgery vulnerability in downloadremotefile that allows shopmanager users to reach internal services via redirects. Attackers can submit a .csv URL that returns an HTTP 302 redirect to an internal...

CVE-2026-118989

The WebToffee Product Import Export for WooCommerce plugin (versions 2.5.1 before 2.6.8 ) is vulnerable to a Server-Side Request Forgery (SSRF) in the download_remote_file function. This flaw allows users with shop_manager privileges to access internal services by submitting a .csv URL that initi...

EUVD-2026-112727

WebToffee Product Import Export for WooCommerce 2.5.1 before 2.6.8 contains a server-side request forgery vulnerability in downloadremotefile that allows shopmanager users to reach internal services via redirects. Attackers can submit a .csv URL that returns an HTTP 302 redirect to an internal...

CVE-2026-118989 WebToffee Product Import Export for WooCommerce 2.5.1 before 2.6.8 SSRF via Redirects

WebToffee Product Import Export for WooCommerce 2.5.1 before 2.6.8 contains a server-side request forgery vulnerability in downloadremotefile that allows shopmanager users to reach internal services via redirects. Attackers can submit a .csv URL that returns an HTTP 302 redirect to an internal...

CVE-2026-56042: Improper Neutralization of Input During Web Page Generation

Customer Cross Site Scripting XSS in Advanced Order Export For WooCommerce = 4.0.9 versions...

CVE-2026-11360: Improper Neutralization of Special Elements used in an SQL Command

The Advanced Order Export For WooCommerce plugin for WordPress is vulnerable to generic SQL Injection via the 'sortdirection' parameter in all versions up to, and including, 4.0.10 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL...

CVE-2026-48971 WordPress Product Import Export for WooCommerce plugin <= 2.5.6 - Broken Access Control vulnerability

Missing Authorization vulnerability in WebToffee Product Import Export for WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Product Import Export for WooCommerce: from n/a through 2.5.6...

CVE-2026-48971: Missing Authorization

Missing Authorization vulnerability in WebToffee Product Import Export for WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Product Import Export for WooCommerce: from n/a through 2.5.6...

CVE-2025-12389: Missing Authorization

The Import Export For WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the updatesetting function in all versions up to, and including, 1.6.2. This makes it possible for authenticated attackers, with Subscriber-level access a...

EUVD-2025-15510

Malicious code in bioql PyPI...

CVE-2025-48144

Cross-Site Request Forgery CSRF vulnerability in sidngr Import Export For WooCommerce import-export-for-woocommerce allows Stored XSS.This issue affects Import Export For WooCommerce: from n/a through = 1.6.2...

CVE-2025-48144

Cross-Site Request Forgery CSRF vulnerability in sidngr Import Export For WooCommerce import-export-for-woocommerce allows Stored XSS.This issue affects Import Export For WooCommerce: from n/a through = 1.6.2...

CVE-2025-48144 WordPress Import Export For WooCommerce plugin <= 1.6.2 - CSRF to Stored XSS vulnerability

Cross-Site Request Forgery CSRF vulnerability in sidngr Import Export For WooCommerce allows Stored XSS. This issue affects Import Export For WooCommerce: from n/a through 1.6.2...

CVE-2025-48144

CVE-2025-48144 is a CSRF-to-Stored XSS vulnerability in the WordPress plugin “Import Export For WooCommerce” affecting versions up to 1.6.2. Public sources in the provided documents confirm a Cross-Site Request Forgery vulnerability that enables Stored XSS, but no patched version or mitigation is...

CVE-2025-48144 WordPress Import Export For WooCommerce plugin <= 1.6.2 - CSRF to Stored XSS vulnerability

Cross-Site Request Forgery CSRF vulnerability in sidngr Import Export For WooCommerce import-export-for-woocommerce allows Stored XSS.This issue affects Import Export For WooCommerce: from n/a through = 1.6.2...

CVE-2025-48144: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in sidngr Import Export For WooCommerce import-export-for-woocommerce allows Stored XSS.This issue affects Import Export For WooCommerce: from n/a through = 1.6.2...

WordPress Plugin: Import/Export for WooCommerce – Cross-Site Request Forgery Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. WordPress plugin is an application plugin that supports personal blog sites on PHP and MySQL servers. A cross-site request forgery vulnerability exists in...

CVE-2025-1912: Server-Side Request Forgery (SSRF)

The Product Import Export for WooCommerce – Import Export Product CSV Suite plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.5.0 via the validatefile Function. This makes it possible for authenticated attackers, with Administrator-level...

CVE-2025-1911: External Control of File Name or Path

The Product Import Export for WooCommerce – Import Export Product CSV Suite plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the adminlogpage function in all versions up to, and including, 2.5.0. This makes it possible for authenticated...

CVE-2025-1769: Improper Limitation of a Pathname to a Restricted Directory

The Product Import Export for WooCommerce – Import Export Product CSV Suite plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.5.0 via the downloadfile function. This makes it possible for authenticated attackers, with Administrator-level access and...