Vulnerabilities

TI-2023-28138 CVE-2023-51486 · GHSA-2c5c-7h32-vwfp

Cross-site request forgery in edgarrojas WooCommerce PDF Invoice Builder

LOW 37

Cross-Site Request Forgery (CSRF) vulnerability in RedNao WooCommerce PDF Invoice Builder.This issue affects WooCommerce PDF Invoice Builder: from n/a through 1.2.101.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00221 Published 2024-03-16 No fix listed CWE-352

TI-2023-24729 CVE-2023-46076 · GHSA-mfrv-mqm7-5gq4

WordPress WooCommerce PDF Invoice Builder Plugin <= 1.2.102 is vulnerable to Cross Site Scripting (XSS)

LOW 31

Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in RedNao WooCommerce PDF Invoice Builder, Create invoices, packing slips and more plugin <= 1.2.102 versions.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00382 Published 2023-10-26 No fix listed CWE-79

TI-2023-03517 CVE-2023-3764 · GHSA-22fw-9q6h-9hhc

WooCommerce PDF Invoice Builder <= 1.2.90 - Cross-Site Request Forgery via Save

LOW 20

The WooCommerce PDF Invoice Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.2.90.

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.00289 Published 2023-08-31 No fix listed CWE-352

TI-2023-03849 CVE-2023-4160 · GHSA-gmxx-v33w-3qrx

WooCommerce PDF Invoice Builder <= 1.2.90 - Authenticated (Administrator+) Cross-Site Scripting

LOW 23

The WooCommerce PDF Invoice Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions up to, and including, 1.2.90 due to insufficient input sanitization and output escaping…

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00492 Published 2023-08-31 No fix listed CWE-79

TI-2023-03434 CVE-2023-3677 · GHSA-vq35-p6hm-gc67

WooCommerce PDF Invoice Builder <= 1.2.89 - Authenticated (Subscriber+) SQL Injection via Export

MEDIUM 41

The WooCommerce PDF Invoice Builder plugin for WordPress is vulnerable to SQL Injection via the pageId parameter in versions up to, and including, 1.2.89 due to insufficient escaping on the user supplied parameter and la…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00797 Published 2023-08-31 No fix listed CWE-89

TI-2023-03850 CVE-2023-4161 · GHSA-pg2j-28wx-p6jw

WooCommerce PDF Invoice Builder <= 1.2.90 - Cross-Site Request Forgery to Custom Field Creation

LOW 20

The WooCommerce PDF Invoice Builder for WordPress is vulnerable to Cross-Site Request Forgery due to a missing nonce check on the SaveCustomField function in versions up to, and including, 1.2.90.

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.00311 Published 2023-08-31 No fix listed CWE-352

TI-2023-03931 CVE-2023-4245 · GHSA-9g4w-r84w-x2jw

WooCommerce PDF Invoice Builder <= 1.2.89 - Missing Authorization to Sensitive Information Exposure

LOW 21

The WooCommerce PDF Invoice Builder for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the GetInvoiceDetail function in versions up to, and including, 1.2.89.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00539 Published 2023-08-31 No fix listed CWE-862