cve/2023/CVE-2023-0479.md

### [CVE-2023-0479](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-0479)
![](https://img.shields.io/static/v1?label=Product&message=Print%20Invoice%20%26%20Delivery%20Notes%20for%20WooCommerce&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=0%3C%204.7.2%20&color=brighgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-79%20Cross-Site%20Scripting%20(XSS)&color=brighgreen)

### Description

The Print Invoice & Delivery Notes for WooCommerce WordPress plugin before 4.7.2 is vulnerable to reflected XSS by echoing a GET value in an admin note within the WooCommerce orders page. This means that this vulnerability can be exploited for users with the edit_others_shop_orders capability. WooCommerce must be installed and active. This vulnerability is caused by a urldecode() after cleanup with esc_url_raw(), allowing double encoding.

### POC

#### Reference
- https://wpscan.com/vulnerability/50963747-ae8e-42b4-bb42-cc848be7b92e/

#### Github
No PoCs found on GitHub currently.