WordPress Plugin Vulnerabilities

WooCommerce PDF Invoices & Packing Slips < 2.15.0 - Reflected Cross-Site Scripting

Description

The plugin does not escape some URLs before outputting them in attributes, leading to Reflected Cross-Site Scripting

Proof of Concept

Affects Plugins

Plugin icon
woocommerce-pdf-invoices-packing-slips
Fixed in 2.15.0

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
6.1 (medium)

Miscellaneous

Original Researcher
WPScanTeam
Verified
Yes
WPVDB ID
bc05dde0-98a2-46e3-b2c8-7bdc8c32394b

Timeline

Publicly Published
2022-06-14 (about 3 years ago)
Added
2022-06-14 (about 3 years ago)
Last Updated
2022-06-14 (about 3 years ago)

Other

Published
Title
Published
2025-02-27
Title
Advanced AJAX Product Filters < 1.6.8.2 - Reflected Cross-Site Scripting
Published
2025-06-26
Title
Homey <= 2.4.5 - Reflected Cross-Site Scripting
Published
2025-01-02
Title
Spiritual Gifts Survey <= 0.9.10 - Unauthenticated CSRF to XSS
Published
2024-05-15
Title
Rank Math SEO with AI Best SEO Tools < 1.0.219-beta - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2025-04-10
Title
UXsniff <= 1.2.8 - Reflected Cross-Site Scripting