{"id":"CVE-2023-0479","aliases":["EUVD-2023-12531","GHSA-x6j8-27mr-ghm3"],"status":"published","title":"Print Invoice \u0026 Delivery Notes for WooCommerce \u003c 4.7.2 - Reflected XSS","description":"The Print Invoice \u0026 Delivery Notes for WooCommerce WordPress plugin before 4.7.2 is vulnerable to reflected XSS by echoing a GET value in an admin note within the WooCommerce orders page. This means that this vulnerability can be exploited for users with the edit_others_shop_orders capability. WooCommerce must be installed and active. This vulnerability is caused by a urldecode() after cleanup with esc_url_raw(), allowing double encoding.","severity":{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.00516,"percentile":0.44277,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-79"],"published":"2024-01-16T15:55:08Z","modified":"2026-06-17T05:25:38Z","products":[{"vendor":"tychesoftwares","product":"print invoice \u0026 delivery notes for woocommerce"},{"vendor":"tychesoftwares","product":"print_invoice_\\\u0026_delivery_notes_for_woocommerce"},{"vendor":"unknown","product":"print invoice \u0026 delivery notes for woocommerce"}],"references":[{"url":"https://wpscan.com/vulnerability/50963747-ae8e-42b4-bb42-cc848be7b92e/","tags":["exploit","vdb-entry","technical-description","x_transferred","Exploit","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-0479"},{"url":"https://wpscan.com/vulnerability/50963747-ae8e-42b4-bb42-cc848be7b92e"},{"url":"https://github.com/advisories/GHSA-x6j8-27mr-ghm3"}],"sources":{"cve":[{"id":"CVE-2023-0479","title":"Print Invoice \u0026 Delivery Notes for WooCommerce \u003c 4.7.2 - Reflected XSS ","description":"The Print Invoice \u0026 Delivery Notes for WooCommerce WordPress plugin before 4.7.2 is vulnerable to reflected XSS by echoing a GET value in an admin note within the WooCommerce orders page. This means that this vulnerability can be exploited for users with the edit_others_shop_orders capability. WooCommerce must be installed and active. This vulnerability is caused by a urldecode() after cleanup with esc_url_raw(), allowing double encoding.","status":"published","published":"2024-01-16T15:55:08.499Z","modified":"2025-06-20T16:59:19.436Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"adp"}],"updated_at":"2026-11-02T14:35:34.923818Z"}],"euvd":[{"id":"EUVD-2023-12531","description":"The Print Invoice \u0026 Delivery Notes for WooCommerce WordPress plugin before 4.7.2 is vulnerable to reflected XSS by echoing a GET value in an admin note within the WooCommerce orders page. This means that this vulnerability can be exploited for users with the edit_others_shop_orders capability. WooCommerce must be installed and active. This vulnerability is caused by a urldecode() after cleanup with esc_url_raw(), allowing double encoding.","status":"published","published":"2024-01-16T15:55:08Z","modified":"2025-06-20T16:59:19Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T20:32:19.011628Z"}],"ghsa":[{"id":"GHSA-x6j8-27mr-ghm3","title":"The Print Invoice \u0026 Delivery Notes for WooCommerce WordPress plugin before 4.7.2 is vulnerable to...","description":"The Print Invoice \u0026 Delivery Notes for WooCommerce WordPress plugin before 4.7.2 is vulnerable to reflected XSS by echoing a GET value in an admin note within the WooCommerce orders page. This means that this vulnerability can be exploited for users with the edit_others_shop_orders capability. WooCommerce must be installed and active. This vulnerability is caused by a urldecode() after cleanup with esc_url_raw(), allowing double encoding.","status":"published","published":"2024-01-16T18:31:09Z","modified":"2025-06-20T21:31:40Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:02:46.844129Z"}],"nvd":[{"id":"CVE-2023-0479","description":"The Print Invoice \u0026 Delivery Notes for WooCommerce WordPress plugin before 4.7.2 is vulnerable to reflected XSS by echoing a GET value in an admin note within the WooCommerce orders page. This means that this vulnerability can be exploited for users with the edit_others_shop_orders capability. WooCommerce must be installed and active. This vulnerability is caused by a urldecode() after cleanup with esc_url_raw(), allowing double encoding.","status":"published","published":"2024-01-16T16:15:10.58Z","modified":"2026-06-17T05:25:38.727Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"},{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:09:01.900189Z"}]}}