CVE-2023-0479

The Print Invoice & Delivery Notes for WooCommerce plugin before version 4.7.2 contains a reflected cross-site scripting vulnerability where a GET parameter is output unsafely in an admin note displayed on the WooCommerce orders page. Attackers can exploit this flaw by targeting users who possess the edit_others_shop_orders capability, provided WooCommerce is installed and enabled. The vulnerability stems from the use of urldecode() applied after esc_url_raw() sanitization, which permits double encoding to bypass the security measures.

Based on public CVE data (MITRE/NVD).