CVE-2024-11276

The PDF Builder for WooCommerce. Create invoices,packing slips and more plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'page' parameter in all versions up to, and including, 1.2.136 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

• CWE-79

• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3202588%40woo-pdf-invoice-builder&new=3202588%40woo-pdf-invoice-builder&sfp_email=&sfph_mail=
• https://www.wordfence.com/threat-intel/vulnerabilities/id/5f21a86b-52f4-4563-afce-32f1949ce5a1?source=cve

Published

Dec 6, 2024

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-11270The WordPress Webinar Plugin – WebinarPress plugin for WordP…8.8
• CVE-2024-11271The WordPress Webinar Plugin – WebinarPress plugin for WordP…4.3
• CVE-2024-11272The Contact Form & SMTP Plugin for WordPress by PirateForms …6.1
• CVE-2024-11273The Contact Form & SMTP Plugin for WordPress by PirateForms …6.1
• CVE-2024-11274An issue was discovered in GitLab CE/EE affecting all versio…8.7
• CVE-2024-11275The WP Timetics- AI-powered Appointment Booking Calendar and…4.3
• CVE-2024-11277The 404 Solution plugin for WordPress is vulnerable to Refle…6.1
• CVE-2024-11278The GD bbPress Attachments plugin for WordPress is vulnerabl…6.1
• CVE-2024-11279The Schema App Structured Data plugin for WordPress is vulne…6.1
• CVE-2024-1128The Tutor LMS – eLearning and online course solution plugin …3.5
• CVE-2024-11280The PPWP – Password Protect Pages plugin for WordPress is vu…5.3
• CVE-2024-11281The WooCommerce Point of Sale plugin for WordPress is vulner…9.8