CVE-2024-3045 – This stored XSS vulnerability in the PDF Invoic... (How to Fix)

Q: What is the severity of CVE-2024-3045?

CVE-2024-3045 has a CVSS score of 7.2 (HIGH). This stored XSS vulnerability in the PDF Invoices & Packing Slips for WooCommerce WordPress plugin allows unauthenticated attackers to inject malicious scripts into web pages. When users view affected pages, the scripts execute in their browsers, potentially stealing credentials or performing unauthorized actions. All WordPress sites using this plugin version 3.8.0 or earlier are affected.

📋 TL;DR

This stored XSS vulnerability in the PDF Invoices & Packing Slips for WooCommerce WordPress plugin allows unauthenticated attackers to inject malicious scripts into web pages. When users view affected pages, the scripts execute in their browsers, potentially stealing credentials or performing unauthorized actions. All WordPress sites using this plugin version 3.8.0 or earlier are affected.

💻 Affected Systems

Products:

PDF Invoices & Packing Slips for WooCommerce WordPress plugin

Versions: Up to and including version 3.8.0

Operating Systems: All operating systems running WordPress

Default Config Vulnerable: ⚠️ Yes

Notes: All WordPress installations using the vulnerable plugin versions are affected regardless of configuration.

📦 What is this software?

Woocommerce Pdf Invoices\& Packing Slips by Wpovernight

View all CVEs affecting Woocommerce Pdf Invoices\& Packing Slips →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Attackers could steal administrator credentials, take over the WordPress site, install backdoors, or redirect users to malicious sites, potentially leading to complete site compromise and data theft.

🟠

Likely Case

Attackers inject malicious scripts to steal user session cookies, perform actions as logged-in users, or deface the site by modifying page content.

🟢

If Mitigated

With proper web application firewalls and input validation, the risk reduces to minimal impact, though the vulnerability still exists in the codebase.

🌐 Internet-Facing: HIGH

🏢 Internal Only: MEDIUM

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: LIKELY

Unauthenticated Exploit: ⚠️ Yes

Complexity: LOW

The vulnerability requires no authentication and involves simple script injection via insufficiently sanitized parameters.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Version 3.8.1 or later

Vendor Advisory: https://plugins.trac.wordpress.org/changeset/3076105/

Restart Required: No

Instructions:

1. Log into WordPress admin panel. 2. Navigate to Plugins → Installed Plugins. 3. Find 'PDF Invoices & Packing Slips for WooCommerce'. 4. Click 'Update Now' if available, or download version 3.8.1+ from WordPress repository. 5. Activate the updated plugin.

🔧 Temporary Workarounds

Temporary Plugin Deactivation

all

Disable the vulnerable plugin until patched

wp plugin deactivate woocommerce-pdf-invoices-packing-slips

Web Application Firewall Rule

all

Block XSS payloads targeting the vulnerable parameters

Add WAF rule to block scripts in PDF invoice parameters

🧯 If You Can't Patch

Disable the PDF Invoices & Packing Slips plugin completely
Implement strict Content Security Policy (CSP) headers to mitigate script execution

🔍 How to Verify

Check if Vulnerable:

Check WordPress admin → Plugins → Installed Plugins for 'PDF Invoices & Packing Slips for WooCommerce' version 3.8.0 or earlier

Check Version:

wp plugin get woocommerce-pdf-invoices-packing-slips --field=version

Verify Fix Applied:

Verify plugin version is 3.8.1 or later in WordPress admin panel

📡 Detection & Monitoring

Log Indicators:

Unusual POST requests to WooCommerce PDF endpoints with script tags
Multiple failed XSS attempts in web server logs

Network Indicators:

HTTP requests containing script tags in PDF invoice parameters
Unusual traffic patterns to PDF generation endpoints

SIEM Query:

source="web_server_logs" AND (uri="*pdf-invoice*" OR uri="*packing-slip*") AND (content="<script>" OR content="javascript:")

📊 Metadata

CVE ID: CVE-2024-3045

CVSS v3 Score: 7.2 (HIGH)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

CWE: CWE-79

Published: May 2, 2024

Last Updated: February 11, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2024-3045, you might also want to check these: