{"id":"CVE-2022-2537","aliases":["EUVD-2022-34791","GHSA-m267-8vw8-g9w3"],"status":"published","title":"WooCommerce PDF Invoices \u0026 Packing Slips \u003c 3.0.1 - Reflected Cross-Site Scripting","description":"The WooCommerce PDF Invoices \u0026 Packing Slips WordPress plugin before 3.0.1 does not sanitise and escape some parameters before outputting them back in an attributes of an admin page, leading to Reflected Cross-Site Scripting.","severity":{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.00681,"percentile":0.52699,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-79"],"published":"2022-08-29T17:15:36Z","modified":"2026-06-17T04:42:04Z","products":[{"vendor":"unknown","product":"woocommerce pdf invoices \u0026 packing slips"},{"vendor":"wp overnight","product":"woocommerce pdf invoices \u0026 packing slips"},{"vendor":"wpovernight","product":"woocommerce_pdf_invoices\\\u0026_packing_slips"}],"references":[{"url":"https://wpscan.com/vulnerability/ae613148-85d8-47a0-952d-49c29584676f","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-2537"},{"url":"https://github.com/advisories/GHSA-m267-8vw8-g9w3"}],"sources":{"cve":[{"id":"CVE-2022-2537","title":"WooCommerce PDF Invoices \u0026 Packing Slips \u003c 3.0.1 - Reflected Cross-Site Scripting","description":"The WooCommerce PDF Invoices \u0026 Packing Slips WordPress plugin before 3.0.1 does not sanitise and escape some parameters before outputting them back in an attributes of an admin page, leading to Reflected Cross-Site Scripting.","status":"published","published":"2022-08-29T17:15:36Z","modified":"2024-08-03T00:39:08.074Z","cwes":["CWE-79"],"updated_at":"2026-11-02T14:34:32.495407Z"}],"euvd":[{"id":"EUVD-2022-34791","description":"The WooCommerce PDF Invoices \u0026 Packing Slips WordPress plugin before 3.0.1 does not sanitise and escape some parameters before outputting them back in an attributes of an admin page, leading to Reflected Cross-Site Scripting.","status":"published","published":"2022-08-29T17:15:36Z","modified":"2024-08-03T00:39:08Z","updated_at":"2026-11-03T03:25:57.932023Z"}],"ghsa":[{"id":"GHSA-m267-8vw8-g9w3","title":"The WooCommerce PDF Invoices \u0026 Packing Slips WordPress plugin before 3.0.1 does not sanitise and...","description":"The WooCommerce PDF Invoices \u0026 Packing Slips WordPress plugin before 3.0.1 does not sanitise and escape some parameters before outputting them back in an attributes of an admin page, leading to Reflected Cross-Site Scripting.","status":"published","published":"2022-08-29T20:06:47Z","modified":"2023-01-30T05:01:55Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:46:31.204916Z"}],"nvd":[{"id":"CVE-2022-2537","description":"The WooCommerce PDF Invoices \u0026 Packing Slips WordPress plugin before 3.0.1 does not sanitise and escape some parameters before outputting them back in an attributes of an admin page, leading to Reflected Cross-Site Scripting.","status":"published","published":"2022-08-29T18:15:09.477Z","modified":"2026-06-17T04:42:04.843Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:07:25.883929Z"}]}}