The plugin contains an improper neutralization of input that allows stored Cross‑Site Scripting (XSS). When an attacker supplies malicious data via the invoice builder’s form fields, the payload is saved and later rendered in the browser of any user who views the invoice. This can lead to session hijacking, cookie theft, defacement, or execution of arbitrary client‑side code in the context of the victim’s browser. The vulnerability is a classic example of CWE‑79. The exploit requires injection of JavaScript into the stored content, which is then executed when the invoice is displayed to users. Such impact undermines the confidentiality and integrity of user data and can facilitate broader attacks across the site.

Add‑ons.org PDF Invoice Builder for WooCommerce, all WordPress installations running the plugin version 4.6.0 or older. Any site that has this plugin installed is potentially affected. Exact affected version information is limited to the maximum vulnerable release of 4.6.0; earlier versions are also impacted.

The CVSS score of 6.5 reflects a moderate risk to users who view invoices. The EPSS score of <1% indicates a low probability of exploitation at this time, and the vulnerability is not listed in CISA’s KEV catalog. Likely attack vector requires that an attacker have access to the invoice creation or editing interface, typically via an authenticated user with administrative or vendor privileges. Once the malicious payload is stored, any user who opens the invoice will have the script executed in their browser. Knowledge of the exploit is limited and no public scripts are currently known.