PDF Invoices & Packing Slips for WooCommerce: Stored XSS via billing address fields (CVE-2026-107750)
The PDF Invoices & Packing Slips for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping.
CVE search metadata
CVE search record: CVE-2026-107750. Severity: high. CVSS: 7.2. KEV: no. Product: PDF Invoices & Packing Slips for WooCommerce (versions up to and including 5.16.4). Brief: PDF Invoices & Packing Slips for WooCommerce: Stored XSS via billing address fields (CVE-2026-107750). Brief link: https://feed.craftedsignal.io/briefs/2026-10-woocommerce-xss/
CVE search record: CVE-2026-92244. Severity: high. CVSS: 7.2. EPSS: 0.28%. KEV: no. Product: PDF Invoices & Packing Slips for WooCommerce (versions up to and including 5.16.4). Brief: PDF Invoices & Packing Slips for WooCommerce: Stored XSS via billing address fields (CVE-2026-107750). Brief link: https://feed.craftedsignal.io/briefs/2026-10-woocommerce-xss/
Triage facts
Revision 1- Applicability
- PDF Invoices & Packing Slips for WooCommerce (versions up to and including 5.16.4)
- Evidence
- Unknown
- Severity
- High
- Sources
- 1 public source
- Freshness
- Revision 1Oct 31, 07:51 UTC
- Vulnerabilities
- 2 CVEs
- Source quality
- A2Roughly even chance
The PDF Invoices & Packing Slips for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in versions up to and including 5.16.4. The vulnerability affects the 'billing_address.first_name', 'last_name', 'company', and 'customer_note' parameters.
The issue arises from an incomplete fix for CVE-2026-92244; while the 'wp_kses()' function blocks raw-tag payloads, it is bypassed by entity-encoded payloads that contain no literal angle-bracket characters. This allows unauthenticated attackers to inject arbitrary web scripts that execute when a user accesses an injected page.