CVE-2025-24644
CVSS 3.1 Score 4.8 of 10 (medium)
Details
Published Jan 24, 2025
Updated: Feb 11, 2025
CWE ID 79
Summary
CVE-2025-24644 is a Cross-Site Scripting (XSS) vulnerability affecting the WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes, and Shipping Labels plugins. This issue permits attackers to inject malicious scripts into the web pages generated by these plugins, potentially stealing user data or taking control of their sessions. The vulnerability exists in versions from n/a through 4.7.1, making it essential for users to update their plugins as soon as possible to mitigate the risk.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.