Medium severity · published Mar 22, 2024
CVE-2024-0957
WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels <= 4.4.1 - Unauthenticated Stored Cross-Site Scripting
6.1
CVSS
0.4%
EPSS
No
On KEV
Description
The WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Customer Notes field in all versions up to, and including, 4.4.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected invoice for printing.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 31% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WW
WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels · webtoffee
through 4.4.1 · source: vendor
WP
Woocommerce Pdf Invoices, Packing Slips, Delivery Notes And Shipping Labels · Webtoffee
before 4.4.2 · source: NVD
Affected product
WW
WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels
webtoffee
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-0957
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-0957
Patch
https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3050923%40print-invoices-packing-slip-labels-for-woocommerce&new=3050923%40print-invoices-packing-slip-labels-for-woocommerce&sfp_email=&sfph_mail=
Third Party Advisory
https://www.wordfence.com/threat-intel/vulnerabilities/id/c7ba4218-5b60-4e72-b98d-7c95c9fc3d59?source=cve
More from WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels
7.5
CVE-2026-93746
WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels <= 5.0.2 - Insecure Direct Object Reference to Unauthenticated Unauthorized Order Document Access via 'email' Parameter
6.5
CVE-2026-18027
WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels <= 4.9.8 - Authenticated (Subscriber+) Arbitrary File Read via 'customer_note' Parameter
6.5
CVE-2023-7068
WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels <= 4.3.0 - Missing Authorization to Order Export
5.3
CVE-2024-3216
WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels <= 4.4.2 - Missing Authorization to Unauthenticated Settings Reset