PDF Invoices & Packing Slips for WooCommerce (Versions Up to and Including 5.16.4) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/pdf-invoices--packing-slips-for-woocommerce-versions-up-to-and-including-5.16.4/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioSat, 31 Oct 2026 07:51:55 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgPDF Invoices & Packing Slips for WooCommerce: Stored XSS via billing address fields (CVE-2026-107750)https://feed.craftedsignal.io/briefs/2026-10-woocommerce-xss/Sat, 31 Oct 2026 07:51:55 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-woocommerce-xss/The PDF Invoices & Packing Slips for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping.The PDF Invoices & Packing Slips for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in versions up to and including 5.16.4. The vulnerability affects the 'billing_address.first_name', 'last_name', 'company', and 'customer_note' parameters.

The issue arises from an incomplete fix for CVE-2026-92244; while the 'wp_kses()' function blocks raw-tag payloads, it is bypassed by entity-encoded payloads that contain no literal angle-bracket characters. This allows unauthenticated attackers to inject arbitrary web scripts that execute when a user accesses an injected page.

]]>highadvisory