PDF Invoices & Packing Slips for WooCommerce

PDF Invoices & Packing Slips for WooCommerce has 14 disclosed vulnerabilities in the WordSec catalog, reported between 2017 and 2026; all 14 are fixed as of September 2026. Their average CVSS score is 5.7, and the most serious one scores 7.2 out of 10. Severity breakdown: 0 critical and 3 high. 2024 was the busiest year with 4 disclosures.

The most common weakness is Cross-Site Scripting, behind 6 of the records (43%). Other recurring categories include Missing Authorization, Authorization Bypass Through User-Controlled Key.

Every one of the 14 issues recorded for PDF Invoices & Packing Slips for WooCommerce has a vendor fix available, so running the current release closes all known holes.

10 independent researchers contributed these findings, most of them (2) reported by Dmitrii Ignatyev. PDF Invoices & Packing Slips for WooCommerce is installed on roughly 300,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.

01234567891017.01.2014Today02.10.20176.1WooCommerce PDF Invoices & Packing Slips <= 2.0.12 - Cross-Site Scripting CVSS 6.1 · 02.10.201706.12.20214.8WooCommerce PDF Invoices & Packing Slips <= 2.10.4 - Reflected Cross-Site Scripting via tab and section parameter CVSS 4.8 · 06.12.202107.06.20226.1WooCommerce PDF Invoices & Packing Slips <= 2.14.5 - Cross-Site Scripting CVSS 6.1 · 07.06.202216.06.20225.4WooCommerce PDF Invoices & Packing Slips <= 2.15.0 - Reflected Cross-Site Scripting CVSS 5.4 · 16.06.202203.08.20226.1WooCommerce PDF Invoices & Packing Slips 2.14.0 - 3.0.0 - Reflected Cross-Site Scripting CVSS 6.1 · 03.08.202227.01.20234.3WooCommerce PDF Invoices & Packing Slips <= 3.2.5 - Cross Site Request Forgery CVSS 4.3 · 27.01.202312.01.20247.2PDF Invoices & Packing Slips for WooCommerce <= 3.7.6 - Authenticated (Shop Manager+) SQL Injection CVSS 7.2 · 12.01.202424.04.20247.2PDF Invoices & Packing Slips for WooCommerce <= 3.8.0 - Unauthenticated Server-Side Request Forgery CVSS 7.2 · 24.04.20247.2PDF Invoices & Packing Slips for WooCommerce <= 3.8.0 - Unauthenticated Stored Cross-Site Scripting CVSS 7.2 · 24.04.202424.10.20245.3WooCommerce PDF Invoices & Packing Slips <= 3.8.6 - Missing Authorization CVSS 5.3 · 24.10.202407.12.20254.3WooCommerce PDF Invoices & Packing Slips <= 4.9.1 - Missing Authorization CVSS 4.3 · 07.12.202517.02.20264.3PDF Invoices & Packing Slips for WooCommerce <= 5.6.0 - Missing Authorization to Authenticated (Subscriber+) Peppol Identifier Modification CVSS 4.3 · 17.02.202620.04.20266.6PDF Invoices & Packing Slips for WooCommerce < 5.9.0 - Authenticated (Shop manager+) PHP Object Injection CVSS 6.6 · 20.04.202610.07.20264.3PDF Invoices & Packing Slips for WooCommerce <= 5.14.0 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Disclosure via 'order_id' Shortcode Attribute CVSS 4.3 · 10.07.2026

Strategic Overview

Avg CVSSMedium
5.7/ 10
Patch Coverage100%
Open

0

Fixed

14

Get automatic notifications for all PDF Invoices & Packing Slips for WooCommerce vulnerabilities before they are exploited.

Highest severity on recordCVSS 7.2CVE-2024-3047

PDF Invoices & Packing Slips for WooCommerce <= 3.8.0 - Unauthenticated Server-Side Request Forgery

Read the full analysis

Vulnerability Records

14 records
2026-07-10 14:36CVE-2026-13116
4.3
Medium
Dmitrii IgnatyevYes
2026-04-20 00:00CVE-2026-39472
6.6
Medium
darooYes
2026-02-17 17:18CVE-2026-1906
4.3
Medium
Dmitrii IgnatyevYes
2025-12-07 00:00CVE-2025-67589
4.3
Medium
Phat RiOYes
2024-10-24 00:00CVE-2024-50421
5.3
Medium
Rafie MuhammadYes
2024-04-24 00:00CVE-2024-3047
7.2
High
Tim CoenYes
2024-04-24 00:00CVE-2024-3045
7.2
High
Tim CoenYes
2024-01-12 00:00CVE-2024-22147
7.2
High
belugaYes
2023-01-27 00:00CVE-2022-47148
4.3
Medium
Muhammad DaffaYes
2022-08-03 00:00CVE-2022-2537
6.1
Medium
Krzysztof ZającYes
Showing 1–10 of 14 reports
PDF Invoices & Packing Slips for WooCommerce banner
Latestv5.16.1

PDF Invoices & Packing Slips for WooCommerce

WP Overnight

Author

WP Overnight

5.0(1,862)
100/100
Last Updated
2026-08-21 (23d ago)
Active Installs
300,000+
Downloads
23,729,530
Requires WP
4.4+
Requires PHP
7.4+
Tested up to
WP 7.1
Created
2014-01-17 (13y ago)
Requires Plugins
woocommerce

This WooCommerce extension automatically adds a PDF or XML invoice (e-invoicing) to the order confirmation emails sent out to your customers. Includes a basic template (additional templates are available from WP Overnight) as well as the possibility to modify/create your own templates. In addition, you can choose to download or print invoices and packing slips from the WooCommerce order admin. Main features Automatically attach invoice PDF or XML to WooCommerce emails of your choice Download the PDF or XML Invoice / PDF Packing Slip from the order admin page Choose from a range of e‑document formats: UBL 2.1, Peppol BIS 3.0, CII D16B, Factur‑X 1.0, ZUGFeRD 1.0, and ZUGFeRD 2.0. Generate PDF invoices / packing slips in bulk Fully customizable HTML/CSS invoice templates Download invoices from the My Account page Sequential invoice numbers Available in: Czech, Dutch, English, Finnish, French, German, Hungarian, Italian, Japanese (see FAQ for adding custom fonts!), Norwegian, Portuguese, Polish, Romanian, Russian, Slovak, Slovenian, Spanish, Swedish & Ukrainian Free extensions The following free extensions are available to add additional features to the plugin: PDF Invoices & Packing Slips for WooCommerce – mPDF: Adds support for RTL layout and Arabic script. PDF Invoices & Packing Slips for WooCommerce – mPDF CJK: Provides support for Chinese, Japanese, and Korean (CJK) fonts for the mPDF extension. PDF Invoices & Packing Slips for WooCommerce – Unicode Language Pack: Adds support for Chinese, Japanese, and Korean scripts. PDF Invoices & Packing Slips for WooCommerce – Taxes Summary: Adds a taxes summary table after the order details. Premium extensions In addition to this, we offer several premium extensions: Create/email PDF Proforma Invoices, Credit Notes (for Refunds), email Packing Slips, automatic upload to Dropbox, Google Drive & more with PDF Invoices & Packing Slips for WooCommerce Professional Get the complete feature set, including Professional, Premium Templates, and additional features with the WooCommerce PDF Invoices & Packing Slips Plus Bundle Add Peppol network delivery for WooCommerce invoices and credit notes right inside your invoicing workflow. eDocuments for WooCommerce: Peppol Automatically send new orders or packing slips to your printer as soon as the customer orders! WooCommerce Automatic Order Printing (PrintNode) Enable EU VAT number collection, automatic validation and reverse-charge logic right in your WooCommerce store. WooCommerce European (EU/UK/Norway/Switzerland) VAT Compliance Fully customizable In addition to a number of default settings (including a custom header/logo) and several layout fields that you can use out of the box, the plugin contains HTML/CSS-based templates that allow for customization & full control over the PDF output. Copy the templates to your theme folder and you don’t have to worry that your customizations will be overwritten when you update the plugin. Insert customer header image/logo Modify shop data / footer / disclaimer etc. on the invoices & packing slips Select paper size (Letter or A4) Translation ready

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C