Installed this plugin on a client site last week, and today my site was infected with the adclick virus, so had to delete the plugin. I'm a bit annoyed as both my client and I loved the plugin.
These are the files affected
./wp-content/plugins/woocommerce-pdf-invoices/lib/mpdf/classes/bmp.php
./wp-content/plugins/woocommerce-pdf-invoices/lib/mpdf/classes/grad.php
./wp-content/plugins/woocommerce-pdf-invoices/lib/mpdf/classes/mpdfform.php
./wp-content/plugins/woocommerce-pdf-invoices/lib/mpdf/classes/otl.php
./wp-content/plugins/woocommerce-pdf-invoices/lib/mpdf/classes/otl_dump.php
./wp-content/plugins/woocommerce-pdf-invoices/lib/mpdf/classes/ttfontsuni.php
./wp-content/plugins/woocommerce-pdf-invoices/lib/mpdf/config.php
./wp-content/plugins/woocommerce-pdf-invoices/lib/mpdf/ttfontdata/dejavusanscondensed.GDEFdata.php