// For flags

CVE-2023-0479

Print Invoice & Delivery Notes for WooCommerce < 4.7.2 - Reflected XSS

Severity Score

6.1
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

1
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

The Print Invoice & Delivery Notes for WooCommerce WordPress plugin before 4.7.2 is vulnerable to reflected XSS by echoing a GET value in an admin note within the WooCommerce orders page. This means that this vulnerability can be exploited for users with the edit_others_shop_orders capability. WooCommerce must be installed and active. This vulnerability is caused by a urldecode() after cleanup with esc_url_raw(), allowing double encoding.

El complemento Print Invoice &amp; Delivery Notes para WooCommerce WordPress anterior a 4.7.2 es vulnerable al XSS reflejado al hacer eco de un valor GET en una nota administrativa dentro de la página de pedidos de WooCommerce. Esto significa que esta vulnerabilidad puede ser aprovechada por usuarios con la capacidad edit_others_shop_orders. WooCommerce debe estar instalado y activo. Esta vulnerabilidad es causada por un urldecode() después de la limpieza con esc_url_raw(), lo que permite la doble codificación.

The Print Invoice & Delivery Notes for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 4.7.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

*Credits: dc11, WPScan
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Changed
Confidentiality
Low
Integrity
Low
Availability
None
Attack Vector
Network
Attack Complexity
Low
Authentication
None
Confidentiality
Partial
Integrity
Partial
Availability
None
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2023-01-24 CVE Reserved
  • 2023-02-02 CVE Published
  • 2024-08-02 CVE Updated
  • 2024-08-02 First Exploit
  • 2024-12-16 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
CWE
  • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Tychesoftwares
Search vendor "Tychesoftwares"
 Print Invoice \& Delivery Notes For Woocommerce
Search vendor "Tychesoftwares" for product "Print Invoice \& Delivery Notes For Woocommerce"
 < 4.7.2
Search vendor "Tychesoftwares" for product "Print Invoice \& Delivery Notes For Woocommerce" and version " < 4.7.2"
wordpress
Affected