CVE-2021-24991: Wpovernight Woocommerce PDF Invoices& Packing Slips

Medium severity, CVSS 4.8. EPSS: 1.2% chance of exploitation in the next 30 days.

The WooCommerce PDF Invoices & Packing Slips WordPress plugin before 2.10.5 does not escape the tab and section parameters before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting in the admin dashboard

Affected products

• Wpovernight Woocommerce PDF Invoices& Packing Slips: before 2.10.5 (fixed in 2.10.5)

Published 2022-01-03. Last modified 2026-06-17.