Decorator Woocommerce Email Customizer Vulnerabilities

The WebToffee eCommerce Marketing Automation – Email marketing, Popups, Email customizer plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 2.1.1. This makes it possible for authenticated attackers, with Subscriber-level access...

CVSS:

4.3

Affected:

up to 2.1.1

Fixed in:

2.1.2

Disclosed:

Oct 30, 2025

CVE-2025-67599 on NVD →

The Decorator – WooCommerce Email Customizer plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.7. This is due to missing nonce validation on several functions such as ajax_reset(), wt_decorator_button_text(), wt_decorator_set_as_default(), and more. This makes it...

CVSS:

4.3

Affected:

up to 1.2.7

Fixed in:

1.2.8

Disclosed:

Nov 2, 2023

CVE-2023-48284 on NVD →