Medium · 5.9 CVE-2025-24644 EUVD-2025-3843GHSA-6xwx-qgg8-v5m5

WordPress WooCommerce PDF Invoices plugin <= 4.7.1 - Stored Cross Site Scripting (XSS) vulnerability

Published Jan 24, 2025 · Updated Apr 28, 2026 · Assigned by Patchstack

Vendor: WebToffee Product: WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels Category: Web / CMS

Description

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels print-invoices-packing-slip-labels-for-woocommerce allows Stored XSS.This issue affects WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels: from n/a through <= 4.7.1.

Affected products

Vendor	Product	Affected	Fixed
WebToffee	WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels	≤ 4.7.1	—

References

https://patchstack.com/database/Wordpress/Plugin/print-invoices-packing-slip-labels-for-woocommerce/vulnerability/wordpress-woocommerce-pdf-invoices-plugin-4-7-1-stored-cross-site-scripting-xss-vulnerability?_s_id=cve vdb-entry