This vulnerability is an improper neutralization of user input that allows attackers to embed malicious JavaScript into content that is later rendered as part of a PDF invoice or its preview page. The stored payload is accepted and saved by the plugin’s input forms, and then executed whenever a visitor views the generated PDF or the preview interface, enabling compromise of the site’s confidentiality, integrity, or availability. The weakness is classified as CWE‑79. The potential impact includes session hijacking, data exfiltration, or unauthorized actions performed in the authenticated user’s context.

The affected product is WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels, specifically any installation running version 4.7.1 or earlier. No further version granularity is specified beyond the ≤4.7.1 limit.

The CVSS base score is 5.9, indicating a medium severity vulnerability; the EPSS score is reported as < 1 %, implying a low likelihood of exploitation at the moment. The vulnerability is not listed in the CISA KEV catalog, suggesting no confirmed widespread exploitation yet. Because the flaw requires the attacker to submit data through the plugin’s administrative interfaces, it is likely limited to individuals with editing or administrative privileges, but the stored nature means any subsequent user who opens the affected PDF would be exposed.