CVE-2026-92244: PDF Invoices & Packing Slips for WooCommerce <= 5.16.1 - Unauthenticated Stored Cross-Site Scripting via Billing First Name / Last Name / Company Fields
The PDF Invoices & Packing Slips for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Billing First Name / Last Name / Company Fields in all versions up to, and including, 5.16.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload survives initial storage because WooCommerce's sanitizetextfield() and wcclean() do not strip entity-encoded strings containing no literal '<' character, allowing unauthenticated guest-checkout orders to plant the malicious content.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker does not need authentication if the store permits guest checkout. They can place an order containing entity-encoded script content in the billing first name, last name, or company field.
When does the malicious script execute?
The payload is stored with the order and executes when a user accesses a page that renders the injected billing data. The issue affects versions through 5.16.1.
What should be checked to determine exposure?
Determine whether the plugin version is 5.16.1 or earlier and whether guest checkout is enabled. Review guest-order billing first name, last name, and company values for suspicious entity-encoded content.
What can be done if patching is not immediately possible?
Disabling guest checkout prevents unauthenticated attackers from using guest orders to plant the described payload. Existing orders should still be reviewed because stored payloads may execute when their billing data is displayed.