CVE-2023-0479

Print Invoice & Delivery Notes for WooCommerce < 4.7.2 - Reflected XSS

Medium · published January 16, 2024

CVSS v3.1
6.1
EPSS
1%
Percentile
43.1
In the wild
Unconfirmed
What it is

The Print Invoice & Delivery Notes for WooCommerce WordPress plugin before 4.7.2 is vulnerable to reflected XSS by echoing a GET value in an admin note within the WooCommerce orders page. This means that this vulnerability can be exploited for users with the edit_others_shop_orders capability. WooCommerce must be installed and active. This vulnerability is caused by a urldecode() after cleanup with esc_url_raw(), allowing double encoding.

The record
Technical detail
CVSS v3.1
6.1 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00516 · 43.1th percentile
Published
2024-01-16T15:55Z
EPSS history
Timeline
  • 16 JAN 15:55Z
    Print Invoice & Delivery Notes for WooCommerce < 4.7.2 - Reflected XSS
    cvelistv5