Vulnerability Description
The Print Invoice & Delivery Notes for WooCommerce WordPress plugin before 4.7.2 is vulnerable to reflected XSS by echoing a GET value in an admin note within the WooCommerce orders page. This means that this vulnerability can be exploited for users with the edit_others_shop_orders capability. WooCommerce must be installed and active. This vulnerability is caused by a urldecode() after cleanup with esc_url_raw(), allowing double encoding.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Tychesoftwares | Print Invoice \& Delivery Notes For Woocommerce | < 4.7.2 |
Related Weaknesses (CWE)
References
- https://wpscan.com/vulnerability/50963747-ae8e-42b4-bb42-cc848be7b92e/ExploitThird Party Advisory
- https://wpscan.com/vulnerability/50963747-ae8e-42b4-bb42-cc848be7b92e/ExploitThird Party Advisory
FAQ
What is CVE-2023-0479?
CVE-2023-0479 is a vulnerability with a CVSS score of 6.1 (MEDIUM). The Print Invoice & Delivery Notes for WooCommerce WordPress plugin before 4.7.2 is vulnerable to reflected XSS by echoing a GET value in an admin note within the WooCommerce orders page. This means t...
How severe is CVE-2023-0479?
CVE-2023-0479 has been rated MEDIUM with a CVSS base score of 6.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2023-0479?
Check the references section above for vendor advisories and patch information. Affected products include: Tychesoftwares Print Invoice \& Delivery Notes For Woocommerce.