Live › vulnerability › CVE-2026-111578
The PDF Invoices & Packing Slips for WooCommerce WordPress plugin does not escape customer billing, shipping and order-note fields in generated invoices and packing slips. A guest who places an order can store a script that runs in the browser of a shop administrator who opens the document.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 22:25 UTC. All times on this page are UTC.
Stores running the PDF Invoices & Packing Slips for WooCommerce plugin from 5.16.2 up to but not including 5.16.5 are exposed, because guest checkout data flows into generated documents that administrators open. Sites that do not use this plugin, or that have upgraded to 5.16.5 or later, can skip it.
No product ranges from the sources yet.
wp-content/plugins/ for the PDF Invoices & Packing Slips for WooCommerce plugin.5.16.5.5.16.5Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The PDF Invoices & Packing Slips for WooCommerce WordPress plugin from 5.16.2 before 5.16.5 does not properly escape several customer-supplied order fields — including the billing and shipping address values and the customer order note — before they are output in generated invoice and packing-slip documents, allowing unauthenticated users placing guest orders to store a malicious script that executes when a shop administrator views the document, leading to Stored Cross-Site Scripting.
This page as .md · .json · in your agent: get_signal("CVE-2026-111578")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.