WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels vulnerabilities

9 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 4 published in the last 12 months.

Check whether your WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels version is affected

Latest WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels vulnerabilities

CVE-2026-93746 — WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels <= 5.0.2 - Insecure Direct Object Reference to Unauthenticated Unauthorized Order Document Access via 'email' Parameter (CVSS 7.5)
CVE-2026-18027 — WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels <= 4.9.8 - Authenticated (Subscriber+) Arbitrary File Read via 'customer_note' Parameter (CVSS 6.5)
CVE-2026-49056 — WordPress WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels plugin <= 4.9.4 - Sensitive Data Exposure vulnerability (CVSS 7.5)
CVE-2025-24644 — WordPress WooCommerce PDF Invoices plugin <= 4.7.1 - Stored Cross Site Scripting (XSS) vulnerability (CVSS 4.8)
CVE-2023-51546 — WordPress WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels plugin <= 4.2.1 - Privilege Escalation vulnerability (CVSS 7.2)
CVE-2024-3216 — WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels <= 4.4.2 - Missing Authorization to Unauthenticated Settings Reset (CVSS 5.3)
CVE-2024-22288 — WordPress WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels plugin <= 4.4.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 6.1)
CVE-2024-0957 — WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels <= 4.4.1 - Unauthenticated Stored Cross-Site Scripting (CVSS 6.1)
CVE-2023-7068 — WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels <= 4.3.0 - Missing Authorization to Order Export (CVSS 6.5)