CVE-2026-107750: PDF Invoices & Packing Slips for WooCommerce <= 5.16.4 - Unauthenticated Stored Cross-Site Scripting via Billing First Name / Last Name / Company / Customer Note fields at guest checkout

Published Oct 31, 2026

Updated

The PDF Invoices & Packing Slips for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'billingaddress.firstname / lastname / company, customernote' parameter in all versions up to, and including, 5.16.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is an incomplete fix for CVE-2026-92244: the wpkses() allow-list introduced in 5.16.2 correctly blocks raw-tag payloads but is bypassed by entity-encoded payloads (e.g., <img onerror=…>) that contain no literal angle-bracket characters and are therefore passed through unmodified before the trailing decode rematerializes them.

Event History

Oct 31, 2026

CVE Published

via MITRE·06:44 AM

Data Sourced

via MITRE·06:44 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·07:16 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An unauthenticated attacker can exploit it through guest checkout by supplying a malicious payload in the billing first name, last name, company, or customer note fields. No account or prior privileges are required.

Which installations are affected?

All plugin versions up to and including 5.16.4 are affected. The issue remains exploitable despite the wp_kses() allow-list added in version 5.16.2 because entity-encoded payloads can bypass it.

What conditions trigger the malicious script?

The attacker’s script is stored in order-related data and executes when a user accesses a page containing the injected content. The attack can affect users who view the relevant injected page.

How does the bypass work?

Raw HTML-tag payloads are blocked by the allow-list, but entity-encoded markup such as <img onerror=…> contains no literal angle brackets at the filtering stage. A later decode operation rematerializes the markup, allowing the script to execute.

CVE-2026-107750: PDF Invoices & Packing Slips for WooCommerce <= 5.16.4 - Unauthenticated Stored Cross-Site Scripting via Billing First Name / Last Name / Company / Customer Note fields at guest checkout

Event History

Frequently Asked Questions

Who can exploit this issue?

Which installations are affected?

What conditions trigger the malicious script?

How does the bypass work?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

Which installations are affected?

What conditions trigger the malicious script?

How does the bypass work?