CVE-2023-48284

Cross-Site Request Forgery CSRF vulnerability in WebToffee Decorator – WooCommerce Email Customizer allows Cross Site Request Forgery.This issue affects Decorator – WooCommerce Email Customizer: from n/a through 1.2.7...

CVE-2023-48284

Cross-Site Request Forgery CSRF vulnerability in WebToffee Decorator – WooCommerce Email Customizer allows Cross Site Request Forgery.This issue affects Decorator – WooCommerce Email Customizer: from n/a through 1.2.7...

Cross site request forgery (csrf)

Cross-Site Request Forgery CSRF vulnerability in WebToffee Decorator – WooCommerce Email Customizer allows Cross Site Request Forgery.This issue affects Decorator – WooCommerce Email Customizer: from n/a through 1.2.7...

CVE-2023-48284

The CVE-2023-48284 entry describes a Cross-Site Request Forgery (CSRF) vulnerability in the WordPress plugin Decorator – WooCommerce Email Customizer (versions up to 1.2.7). The underlying issue is CSRF due to insufficient anti-forgery protections (missing nonce validation) in multiple plugin act...

CVE-2022-45370

Improper Neutralization of Formula Elements in a CSV File vulnerability in WebToffee WordPress Comments Import & Export.This issue affects WordPress Comments Import & Export: from n/a through 2.3.1...

CVE-2022-45370

Improper Neutralization of Formula Elements in a CSV File vulnerability in WebToffee WordPress Comments Import & Export.This issue affects WordPress Comments Import & Export: from n/a through 2.3.1...

Input validation

Improper Neutralization of Formula Elements in a CSV File vulnerability in WebToffee WordPress Comments Import & Export.This issue affects WordPress Comments Import & Export: from n/a through 2.3.1...

CVE-2022-45370

The CVE CVE-2022-45370 concerns the WebToffee WordPress Comments Import & Export plugin (versions 2.3.1 and earlier). The issue is an improper neutralization of formula elements in CSV files (CSV Injection) when importing/exporting comments, allowing unauthenticated attackers to craft CSV payload...

CVE-2022-46802

Improper Neutralization of Formula Elements in a CSV File vulnerability in WebToffee Product Reviews Import Export for WooCommerce.This issue affects Product Reviews Import Export for WooCommerce: from n/a through 1.4.8...

CVE-2022-46802

Improper Neutralization of Formula Elements in a CSV File vulnerability in WebToffee Product Reviews Import Export for WooCommerce.This issue affects Product Reviews Import Export for WooCommerce: from n/a through 1.4.8...

Input validation

Improper Neutralization of Formula Elements in a CSV File vulnerability in WebToffee Product Reviews Import Export for WooCommerce.This issue affects Product Reviews Import Export for WooCommerce: from n/a through 1.4.8...

CVE-2022-46802

The CVE-2022-46802 issue affects WebToffee Product Reviews Import Export for WooCommerce versions ≤ 1.4.8, caused by improper neutralization of formula elements in CSV files (CSV injection). Remediation: upgrade to version 1.4.9 or newer where the fix is implemented. Exploitability remains unclea...

PT-2023-14657 · WordPress · Webtoffee Wordpress Comments Import & Export

Name of the Vulnerable Software and Affected Versions: WebToffee WordPress Comments Import & Export versions 2.3.1 and earlier Description: The issue is related to the improper neutralization of formula elements in a CSV file. This can potentially lead to unintended consequences when importing or...

PT-2023-15046 · Unknown · Webtoffee Product Reviews Import Export For Woocommerce

Name of the Vulnerable Software and Affected Versions: WebToffee Product Reviews Import Export for WooCommerce versions 1.4.8 and earlier Description: The issue is related to the improper neutralization of formula elements in a CSV file, which can lead to potential security risks. Recommendations...

WebToffee Addresses Authentication Bypass Vulnerability in Stripe Payment Plugin for WooCommerce WordPress Plugin

On June 8, 2023, our Wordfence Threat Intelligence team identified and began the responsible disclosure process for an Authentication Bypass vulnerability in WebToffee’s Stripe Payment Plugin for WooCommerce plugin, which is actively installed on more than 10,000 WordPress websites. This...

Multiple WebToffee Plugins - Cross-Site Request Forgery (CSRF) Issue

From https://www.wordfence.com/blog/2020/03/vulnerability-patched-in-import-export-wordpress-users/ at the bottom "Several additional WooCommerce-centric import/export plugins from WebToffee used the same import functionality. However, they were unable to be activated unless WooCommerce was...

WordPress Plugin Import Export WordPress Users 1.3.1 - CSV Injection

WordPress Plugin Import Export WordPress Users 1.3.1 - CSV Injection Exploit Title: Wordpress Plugin Import Export WordPress Users = 1.3.1 - CSV Injection Exploit Author: Javier Olmedo Contact: @jjavierolmedo Website: https://sidertia.com Date: 2018-08-22 Google Dork:...

WordPress Import Export WordPress Users 1.3.1 Plugin - CSV Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: Wordpress Plugin Import Export WordPress Users = 1.3.1 - CSV Injection Exploit Author: Javier Olmedo Contact: @jjavierolmedo Website: https://sidertia.com Google Dork:...

WordPress Plugin Import Export WordPress Users 1.3.1 - CSV Injection

Exploit Title: Wordpress Plugin Import Export WordPress Users = 1.3.1 - CSV Injection Exploit Author: Javier Olmedo Contact: @jjavierolmedo Website: https://sidertia.com Date: 2018-08-22 Google Dork: inurl:"/wp-content/plugins/users-customers-import-export-for-wp-woocommerce" Vendor: WebToffee...

CVE-2019-15092

The CVE-2019-15092 entry concerns the WebToffee WordPress plugin “Users & WooCommerce Customers Import Export” (WordPress plugin). Affected version: 1.3.0 of the plugin allows CSV injection in exported files via the WF_CustomerImpExpCsv_Exporter class, specifically in the user_url, display_name, ...