WebToffee Import Export WordPress Users vulnerabilities (CVE)

CVE records published for WebToffee Import Export WordPress Users, newest first. Follow to get an email when a new one appears.

6 results

4.9Medium

CVE-2025-1973 1 year ago

Export and Import Users and Customers <= 2.6.2 - Directory Traversal to Authenticated (Administrator+) Limited Arbitrary File Read via download_file Function

webtoffee Export and Import Users and Customers

The Export and Import Users and Customers plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 2.6.2 via the download_file() function. This makes it possible for authenticated attackers, with Administrator-level access an…

7.6High

CVE-2025-1970 1 year ago

Export and Import Users and Customers <= 2.6.2 - Authenticated (Administrator+) Server-Side Request Forgery via validate_file Function

webtoffee Export and Import Users and Customers

The Export and Import Users and Customers plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.6.2 via the validate_file() function. This makes it possible for authenticated attackers, with Administrator-le…

2.7Low

CVE-2025-1972 1 year ago

Export and Import Users and Customers <= 2.6.2 - Directory Traversal to Authenticated (Administrator+) Limited Arbitrary File Deletion via admin_log_page Function

webtoffee Export and Import Users and Customers

The Export and Import Users and Customers plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the admin_log_page() function in all versions up to, and including, 2.6.2. This makes it possible for authentic…

7.2High

CVE-2025-1971 1 year ago

Export and Import Users and Customers <= 2.6.2 - Authenticated (Admin+) PHP Object Injection via form_data Parameter

webtoffee Export and Import Users and Customers

The Export and Import Users and Customers plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.6.2 via deserialization of untrusted input from the 'form_data' parameter. This makes it possible for authenticated at…

5.4Medium

CVE-2024-32835 2 years ago

WordPress Export and Import Users and Customers plugin <= 2.5.3 - Deserialization of untrusted data vulnerability

WebToffee Import Export WordPress Users; wordpress import_export_wordpress_users

Deserialization of Untrusted Data vulnerability in WebToffee Import Export WordPress Users.This issue affects Import Export WordPress Users: from n/a through 2.5.3.

4.3Medium

CVE-2024-30492 2 years ago

WordPress Export and Import Users and Customers plugin <= 2.5.2 - Path Traversal vulnerability

WebToffee Import Export WordPress Users; webtoffee import_export_wordpress_users

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in WebToffee Import Export WordPress Users.This issue affects Import Export WordPress Users: from n/a through 2.5.2.