CVE Database /
CVE-2025-24644
CVE · Medium
CVE-2025-24644 — WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels [print-invoices-packing-slip-labels-for-woocommerce] < 4.7.2
| CVE |
Vulnerability |
Type |
Severity |
Affected |
Fixed in |
Published |
Status |
|
CVE-2025-24644
|
WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels [print-invoices-packing-slip-labels-for-woocommerce] < 4.7.2 |
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') |
Medium
5.9
|
< 4.7.2
|
4.7.2 |
2025-01-24 |
—
|
CVE-2025-24644
A stored cross-site scripting vulnerability exists within the WooCommerce PDF Invoices plugin for WordPress, affecting all versions up to 4.7.1. The issue arises from inadequate handling of input data, allowing malicious users with elevated permissions to embed executable code on specific pages that will be triggered when accessed by other users. This weakness specifically targets multi-site configurations where unfiltered HTML has been restricted.
Based on public CVE data (MITRE/NVD).
Scan your WordPress site free
No signup, no credit card — enter your URL and get a security report in seconds.
See the full security page for this plugin
Browse the CVE database
Browse all security findings