Stored Cross-Site Scripting Vulnerability in WooCommerce PDF Invoices & Packing Slips Plugin

CVE-2024-3045

Summary

The WooCommerce PDF Invoices & Packing Slips plugin for WordPress has a vulnerability that allows for Stored Cross-Site Scripting (XSS) through various parameters. This issue arises from insufficient input sanitization and output escaping in versions up to and including 3.8.0. An unauthenticated attacker can exploit this vulnerability to inject arbitrary web scripts into pages, which will be executed every time a user accesses the affected page. It is crucial for website owners using this plugin to assess their installations and apply necessary updates to safeguard against such vulnerabilities.

References