The WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels plugin for WordPress suffers from a stored cross-site scripting vulnerability (CWE-79) in the Customer Notes field. This vulnerability allows unauthenticated attackers to inject malicious scripts that execute when a user accesses an affected invoice. The issue arises from insufficient sanitization and escaping of user input before rendering it in web pages generated by the plugin. The vulnerability affects all versions up to 4.4.1. The CVSS 3.1 base score is 6.1, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, and partial impact on confidentiality and integrity.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of the affected user's browser when viewing an injected invoice. This may lead to information disclosure or manipulation of data visible to the user. The vulnerability does not impact availability. No known active exploits have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution when handling invoices containing customer notes from untrusted sources. Monitoring vendor channels for updates or patches is recommended.