CVE-2025-24755: PDF Invoice Builder XSS Vulnerability

CVE-2025-24755 Overview

CVE-2025-24755 is a stored Cross-Site Scripting (XSS) vulnerability [CWE-79] in the PDF Invoice Builder for WooCommerce WordPress plugin (pdf-for-woocommerce) developed by add-ons.org. The flaw affects all plugin versions up to and including 4.6.0. An authenticated attacker with low privileges can inject persistent JavaScript payloads that execute in the browser of any user who views the affected page.

The vulnerability requires user interaction and results in a scope change, meaning injected scripts can affect resources beyond the vulnerable component. Successful exploitation can lead to session theft, account takeover, and unauthorized administrative actions within WooCommerce storefronts.

Critical Impact
Attackers with low-privilege access can persist malicious JavaScript that executes against site administrators and customers, enabling credential theft and unauthorized WooCommerce actions.

Affected Products

PDF Invoice Builder for WooCommerce (pdf-for-woocommerce) versions through 4.6.0
WordPress sites running the add-ons.org PDF Invoice Builder plugin
WooCommerce deployments using vulnerable plugin builds

Discovery Timeline

2025-01-24 - CVE-2025-24755 published to the National Vulnerability Database
2026-06-17 - Last updated in the NVD database

Technical Details for CVE-2025-24755

Vulnerability Analysis

The vulnerability stems from improper neutralization of user-supplied input during web page generation within the PDF Invoice Builder for WooCommerce plugin. Input processed by the plugin is rendered into HTML output without adequate sanitization or output encoding. This allows attacker-controlled data to be interpreted as executable JavaScript in the context of the WordPress site.

Because the payload is stored server-side, the injected script executes every time an affected page is rendered. Any user visiting or previewing the tampered content triggers execution in their session. The stored nature amplifies impact compared to reflected XSS, since the attacker does not need to lure victims to a crafted URL.

Root Cause

The root cause is a failure to apply WordPress sanitization primitives such as sanitize_text_field(), wp_kses(), or esc_html() and esc_attr() when handling input that flows into rendered HTML. Data crossing the trust boundary from user input to the generated invoice or admin interface is not neutralized before being emitted into the response body.

Attack Vector

Exploitation requires an attacker to hold a low-privilege authenticated account on the target WordPress site. The attacker submits a crafted payload containing HTML or JavaScript through a plugin input field that is later rendered without escaping. When an administrator or another authenticated user views the affected view, the injected script executes with the victim's privileges.

Because the scope changes across security boundaries, the injected script can interact with WordPress administrative APIs, exfiltrate session cookies, create new administrative accounts, or pivot to further compromise of the WooCommerce store. See the Patchstack XSS Vulnerability Advisory for additional technical context.

Detection Methods for CVE-2025-24755

Indicators of Compromise

Unexpected <script>, <iframe>, or event-handler attributes (for example onerror=, onload=) stored in WooCommerce invoice fields or plugin-managed database tables
New administrative WordPress accounts created shortly after invoice or plugin views by privileged users
Outbound HTTP requests from administrator browsers to unfamiliar domains coinciding with WooCommerce admin activity

Detection Strategies

Audit wp_options, wp_postmeta, and plugin-specific tables for HTML tags or JavaScript syntax in fields expected to hold plain text
Review web server access logs for POST requests to plugin endpoints containing URL-encoded script payloads
Implement a Content Security Policy (CSP) with reporting to identify blocked inline script executions on WooCommerce pages

Monitoring Recommendations

Alert on modifications to WordPress user roles, particularly promotion to administrator, following plugin interactions
Monitor plugin file integrity and version metadata to confirm patched builds remain deployed
Track browser-side script errors and CSP violation reports originating from /wp-admin/ invoice preview pages

How to Mitigate CVE-2025-24755

Immediate Actions Required

Update the PDF Invoice Builder for WooCommerce plugin to a version later than 4.6.0 as soon as the vendor publishes a fixed release
Audit all low-privilege user accounts and remove or disable any that are unused or unrecognized
Rotate WordPress administrator credentials and invalidate active sessions if suspicious stored content is discovered

Patch Information

At the time of publication, the advisory lists all versions through 4.6.0 as affected. Site operators should consult the Patchstack XSS Vulnerability Advisory and the WordPress plugin repository for the latest patched release and apply it immediately.

Workarounds

Deactivate the PDF Invoice Builder for WooCommerce plugin until a patched version is installed
Deploy a Web Application Firewall (WAF) rule to block requests containing HTML or JavaScript tags targeting the plugin's endpoints
Enforce a strict Content Security Policy that disallows inline scripts on WordPress administrative pages
Restrict who can access the WordPress editor and plugin views by tightening role assignments

bash

# Example WordPress CLI commands to disable the plugin and audit users
wp plugin deactivate pdf-for-woocommerce
wp user list --role=administrator --fields=ID,user_login,user_email,user_registered
wp option get active_plugins