Webtoffee Product Feed Vulnerabilities

The WebToffee WooCommerce Product Feeds – Google Shopping, Pinterest, TikTok Ads, & More plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 2.3.3 via deserialization of untrusted input. This makes it possible for authenticated attackers, with shop manager-level access and above...

CVSS:

6.6

Affected:

up to 2.3.3

Fixed in:

2.3.4

Disclosed:

Mar 5, 2026

CVE-2026-22480 on NVD →

[en] Missing Authorization vulnerability in WebToffee Product Feed for WooCommerce webtoffee-product-feed allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Product Feed for WooCommerce: from n/a through <= 2.3.1.

Affected:

up to 2.3.1

Fix:

No patched version reported

Disclosed:

Nov 21, 2025

CVE-2025-66089 on NVD →

The WebToffee WooCommerce Product Feeds – Google Shopping, Pinterest, TikTok Ads, & More plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 2.3.1. This makes it possible for authenticated attackers, with Subscriber-level access...

CVSS:

4.3

Affected:

up to 2.3.1

Fixed in:

2.3.2

Disclosed:

Oct 30, 2025

CVE-2025-66089 on NVD →

[en] Missing Authorization vulnerability in WebToffee Product Feed for WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Product Feed for WooCommerce: from n/a through 2.2.8.

Affected:

up to 2.2.9

Fixed in:

2.2.9

Disclosed:

Jun 6, 2025

CVE-2025-49287 on NVD →

The Product Feed for WooCommerce – Google Shopping Feed, Pinterest Feed, TikTok Ads & More plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 2.2.8. This makes it possible for authenticated attackers, with Subscriber-level acce...

CVSS:

4.3

Affected:

up to 2.2.8

Fixed in:

2.2.9

Disclosed:

Jun 5, 2025

CVE-2025-49287 on NVD →