Print Invoices Packing Slip Labels For Woocommerce Vulnerabilities

The WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 4.9.8 via the get_image_src_in_base64 function. This makes it possible for authenticated attackers, with subscriber-level access and abo...

CVSS:

6.5

Affected:

up to 4.9.8

Fixed in:

5.0.0

Disclosed:

Aug 22, 2026

CVE-2026-18027 on NVD →

The WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.9.4. This makes it possible for unauthenticated attackers to extract sensitive user or configuration data.

CVSS:

5.3

Affected:

up to 4.9.4

Fixed in:

4.9.5

Disclosed:

Jun 3, 2026

CVE-2026-49056 on NVD →

The WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 4.7.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Shop Manager-...

CVSS:

4.4

Affected:

up to 4.7.1

Fixed in:

4.7.2

Disclosed:

Jan 24, 2025

CVE-2025-24644 on NVD →

The WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wt_pklist_reset_settings() function in all versions up to, and including, 4.4.2. This makes it possible for unauthenticated att...

CVSS:

5.3

Affected:

up to 4.4.2

Fixed in:

4.4.3

Disclosed:

Apr 5, 2024

CVE-2024-3216 on NVD →

The WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels plugin for WordPress is vulnerable to Reflected Cross-Site Scripting parameter in versions up to, and including, 4.4.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to injec...

CVSS:

6.1

Affected:

up to 4.4.0

Fixed in:

4.4.1

Disclosed:

Mar 26, 2024

CVE-2024-22288 on NVD →

The WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Customer Notes field in all versions up to, and including, 4.4.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticate...

CVSS:

6.1

Affected:

up to 4.4.1

Fixed in:

4.4.2

Disclosed:

Mar 21, 2024

CVE-2024-0957 on NVD →

The WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on theprint_packinglist action in all versions up to, and including, 4.3.0. This makes it possible for authenticated attackers, with subscri...

CVSS:

4.3

Affected:

up to 4.3.0

Fixed in:

4.3.1

Disclosed:

Jan 2, 2024

CVE-2023-7068 on NVD →

The WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels plugin for WordPress is vulnerable to arbitrary options updates via the JSON import functionality in all versions up to, and including, 4.2.1. This makes it possible for authenticated attackers, with Shop Manager access and above, to update...

CVSS:

7.2

Affected:

up to 4.2.1

Fixed in:

4.3.0

Disclosed:

Dec 27, 2023

CVE-2023-51546 on NVD →