{"id":"CVE-2026-111578","kind":"vulnerability","aliases":["CVE-2026-111578"],"related":[],"title":"WordPress PDF Invoices plugin: guest order fields enable stored cross-site scripting","description":"The PDF Invoices & Packing Slips for WooCommerce WordPress plugin from 5.16.2 before 5.16.5 does not properly escape several customer-supplied order fields — including the billing and shipping address values and the customer order note — before they are output in generated invoice and packing-slip documents, allowing unauthenticated users placing guest orders to store a malicious script that executes when a shop administrator views the document, leading to Stored Cross-Site Scripting.","summary":"The PDF Invoices & Packing Slips for WooCommerce WordPress plugin does not escape customer billing, shipping and order-note fields in generated invoices and packing slips. A guest who places an order can store a script that runs in the browser of a shop administrator who opens the document.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","pdf-invoices-packing-slips","woocommerce","wordpress"],"not_affected_if":["plugin-not-installed","plugin-version-5.16.5-or-later"],"how_to_check":"- Check the installed version of the plugin in the WordPress admin under Plugins, or in `wp-content/plugins/` for the PDF Invoices & Packing Slips for WooCommerce plugin.\n- Confirm whether the installed version is at or above `5.16.5`.","fix":"- PDF Invoices & Packing Slips for WooCommerce: `5.16.5`","status":"open","published_at":"2026-10-30T22:16:53+00:00","first_seen_at":"2026-10-30T22:25:56+00:00","triaged_at":"2026-10-30T22:27:06+00:00","updated_at":"2026-10-30T22:27:06+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-30T22:27:06Z","model":"claude-haiku-5-5","output":{"fix":"- PDF Invoices & Packing Slips for WooCommerce: `5.16.5`","reach":"internet","title":"WordPress PDF Invoices plugin: guest order fields enable stored cross-site scripting","impact":"high","summary":"The PDF Invoices & Packing Slips for WooCommerce WordPress plugin does not escape customer billing, shipping and order-note fields in generated invoices and packing slips. A guest who places an order can store a script that runs in the browser of a shop administrator who opens the document.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","woocommerce","pdf-invoices-packing-slips"],"confidence":0.8,"fix_status":"available","needs_auth":"no","worst_case":"script runs in administrator's browser, hijacking the admin session","analyst_note":"","how_to_check":"- Check the installed version of the plugin in the WordPress admin under Plugins, or in `wp-content/plugins/` for the PDF Invoices & Packing Slips for WooCommerce plugin.\n- Confirm whether the installed version is at or above `5.16.5`.","plain_action":"","needs_analyst":false,"not_affected_if":["plugin-version-5.16.5-or-later","plugin-not-installed"],"who_is_affected":"Stores running the PDF Invoices & Packing Slips for WooCommerce plugin from 5.16.2 up to but not including 5.16.5 are exposed, because guest checkout data flows into generated documents that administrators open. Sites that do not use this plugin, or that have upgraded to 5.16.5 or later, can skip it.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000718,"input_tokens":4191,"output_tokens":598,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-111578':16A,19A '-2026':15A,18A '5.16.2':87C '5.16.5':89C 'address':105C 'administr':72B,140C 'allow':124C 'bill':41B,102C 'browser':68B 'cross':11A,148C 'cross-sit':10A,147C 'custom':40B,96C,109C 'customer-suppli':95C 'cve':14A,17A 'document':76B,123C,143C 'enabl':8A 'escap':39B,93C 'execut':136C 'field':7A,47B,99C 'generat':49B,117C 'guest':5A,55B,128C 'includ':100C 'invoic':3A,23B,30B,50B,79C,118C 'lead':144C 'malici':133C 'note':46B,111C 'open':74B 'order':6A,45B,59B,98C,110C,129C 'order-not':44B 'output':115C 'pack':24B,31B,52B,80C,121C 'packag':20B 'packing-slip':120C 'pdf':2A,22B,29B,78C 'pdf-invoices-packing-slip':21B 'place':57B,127C 'plugin':4A,36B,85C 'proper':92C 'run':65B 'script':13A,63B,134C,150C 'sever':94C 'ship':42B,104C 'shop':71B,139C 'site':12A,149C 'slip':25B,32B,53B,81C,122C 'store':9A,61B,131C,146C 'suppli':97C 'unauthent':125C 'user':126C 'valu':106C 'view':141C 'woocommerc':26B,34B,83C 'wordpress':1A,27B,35B,84C","nicknames":[],"mitigations":[],"who_affected":"Stores running the PDF Invoices & Packing Slips for WooCommerce plugin from 5.16.2 up to but not including 5.16.5 are exposed, because guest checkout data flows into generated documents that administrators open. Sites that do not use this plugin, or that have upgraded to 5.16.5 or later, can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T22:16:53+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"contact@wpscan.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111578","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111578","severity":null,"published_at":"2026-10-30T22:16:53+00:00","modified_at":"2026-10-30T22:16:53+00:00","first_seen_at":"2026-10-30T22:25:56+00:00","fetched_at":"2026-10-30T22:25:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}