Woo Pdf Invoice Builder Vulnerabilities

The PDF Builder for WooCommerce. Create invoices,packing slips and more plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.0.8. This makes it possible for authenticated attackers, with Subscriber-level access and above, to extract sensitive user or configuration...

CVSS:

4.3

Affected:

up to 2.0.8

Fixed in:

2.0.9

Disclosed:

Jul 8, 2026

CVE-2026-57393 on NVD →

The PDF Builder for WooCommerce. Create invoices,packing slips and more plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.0.8. This makes it possible for authenticated attackers, with Subscriber-level access and above, to execute code on the server.

CVSS:

8.8

Affected:

up to 2.0.8

Fixed in:

2.0.9

Disclosed:

Jun 15, 2026

CVE-2026-52704 on NVD →

The PDF Builder for WooCommerce. Create invoices,packing slips and more plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 1.2.150. This makes it possible for authenticated attackers, with Subscriber-level access and above, to...

CVSS:

4.3

Affected:

up to 1.2.150

Fixed in:

1.2.151

Disclosed:

Nov 14, 2025

CVE-2025-64269 on NVD →

[en] Missing Authorization vulnerability in EDGARROJAS WooCommerce PDF Invoice Builder woo-pdf-invoice-builder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WooCommerce PDF Invoice Builder: from n/a through <= 1.2.150.

Affected:

up to 1.2.150

Fix:

No patched version reported

Disclosed:

Nov 13, 2025

CVE-2025-64269 on NVD →

The WooCommerce PDF Invoice Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.2.148. This is due to missing or incorrect nonce validation on the 'clone' case. This makes it possible for unauthenticated attackers to clone invoices via a forged request granted th...

CVSS:

4.3

Affected:

up to 1.2.148

Fixed in:

1.2.149

Disclosed:

Jun 27, 2025

CVE-2025-53203 on NVD →

[en] Cross-Site Request Forgery (CSRF) vulnerability in EDGARROJAS WooCommerce PDF Invoice Builder allows Cross Site Request Forgery. This issue affects WooCommerce PDF Invoice Builder: from n/a through 1.2.148.

Affected:

up to 1.2.149

Fixed in:

1.2.149

Disclosed:

Jun 27, 2025

CVE-2025-53203 on NVD →

[en] The PDF Builder for WooCommerce. Create invoices,packing slips and more plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'page' parameter in all versions up to, and including, 1.2.136 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...

Affected:

up to 1.2.137

Fixed in:

1.2.137

Disclosed:

Dec 6, 2024

CVE-2024-11276 on NVD →

The PDF Builder for WooCommerce. Create invoices,packing slips and more plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'page' parameter in all versions up to, and including, 1.2.136 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attac...

CVSS:

6.1

Affected:

up to 1.2.136

Fixed in:

1.2.137

Disclosed:

Dec 5, 2024

CVE-2024-11276 on NVD →

[en] Cross-Site Request Forgery (CSRF) vulnerability in RedNao WooCommerce PDF Invoice Builder.This issue affects WooCommerce PDF Invoice Builder: from n/a through 1.2.101.

Affected:

up to 1.2.102

Fixed in:

1.2.102

Disclosed:

Mar 16, 2024

CVE-2023-51486 on NVD →

The WooCommerce PDF Invoice Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.2.101. This is due to missing or incorrect nonce validation in the /pages/invoice_list.php file. This makes it possible for unauthenticated attackers to delete invoices via a forged r...

CVSS:

4.3

Affected:

up to 1.2.101

Fixed in:

1.2.102

Disclosed:

Dec 27, 2023

CVE-2023-51486 on NVD →

[en] Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in RedNao WooCommerce PDF Invoice Builder, Create invoices, packing slips and more plugin <= 1.2.102 versions.

Affected:

up to 1.2.104

Fixed in:

1.2.104

Disclosed:

Oct 26, 2023

CVE-2023-46076 on NVD →

The WooCommerce PDF Invoice Builder, Create invoices, packing slips and more plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via an unknown parameter in all versions up to, and including, 1.2.103 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...

CVSS:

6.1

Affected:

up to 1.2.103

Fixed in:

1.2.104

Disclosed:

Oct 16, 2023

CVE-2023-46076 on NVD →

[en] The WooCommerce PDF Invoice Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.2.90. This is due to missing or incorrect nonce validation on the Save function. This makes it possible for unauthenticated attackers to make changes to invoices via a forged req...

Affected:

up to 1.2.91

Fixed in:

1.2.91

Disclosed:

Aug 31, 2023

CVE-2023-3764 on NVD →

[en] The WooCommerce PDF Invoice Builder plugin for WordPress is vulnerable to SQL Injection via the pageId parameter in versions up to, and including, 1.2.89 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for subscribers...

Affected:

up to 1.2.90

Fixed in:

1.2.90

Disclosed:

Aug 31, 2023

CVE-2023-3677 on NVD →

[en] The WooCommerce PDF Invoice Builder for WordPress is vulnerable to Cross-Site Request Forgery due to a missing nonce check on the SaveCustomField function in versions up to, and including, 1.2.90. This makes it possible for unauthenticated attackers to create invoice fields provided they can trick an admin into pe...

Affected:

up to 1.2.91

Fixed in:

1.2.91

Disclosed:

Aug 31, 2023

CVE-2023-4161 on NVD →

[en] The WooCommerce PDF Invoice Builder for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the GetInvoiceDetail function in versions up to, and including, 1.2.89. This makes it possible for subscribers to view arbitrary invoices provided they can guess the order id and invo...

Affected:

up to 1.2.92

Fixed in:

1.2.92

Disclosed:

Aug 31, 2023

CVE-2023-4245 on NVD →

[en] The WooCommerce PDF Invoice Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions up to, and including, 1.2.90 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and...

Affected:

up to 1.2.91

Fixed in:

1.2.91

Disclosed:

Aug 31, 2023

CVE-2023-4160 on NVD →

The WooCommerce PDF Invoice Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions up to, and including, 1.2.90 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above...

CVSS:

4.4

Affected:

up to 1.2.90

Fixed in:

1.2.91

Disclosed:

Aug 18, 2023

CVE-2023-4160 on NVD →

The WooCommerce PDF Invoice Builder for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the GetInvoiceDetail function in versions up to, and including, 1.2.89. This makes it possible for subscribers to view arbitrary invoices provided they can guess the order id and invoice i...

CVSS:

4.3

Affected:

up to 1.2.91

Fixed in:

1.2.92

Disclosed:

Aug 18, 2023

CVE-2023-4245 on NVD →

The WooCommerce PDF Invoice Builder for WordPress is vulnerable to Cross-Site Request Forgery due to a missing nonce check on the SaveCustomField function in versions up to, and including, 1.2.90. This makes it possible for unauthenticated attackers to create invoice fields provided they can trick an admin into perform...

CVSS:

4.3

Affected:

up to 1.2.90

Fixed in:

1.2.91

Disclosed:

Aug 16, 2023

CVE-2023-4161 on NVD →

The WooCommerce PDF Invoice Builder plugin for WordPress is vulnerable to SQL Injection via the pageId parameter in versions up to, and including, 1.2.89 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for subscribers or h...

CVSS:

8.8

Affected:

up to 1.2.89

Fixed in:

1.2.90

Disclosed:

Aug 11, 2023

CVE-2023-3677 on NVD →

The WooCommerce PDF Invoice Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.2.90. This is due to missing or incorrect nonce validation on the Save function. This makes it possible for unauthenticated attackers to make changes to invoices via a forged request...

CVSS:

4.3

Affected:

up to 1.2.90

Fixed in:

1.2.91

Disclosed:

Aug 11, 2023

CVE-2023-3764 on NVD →