WooCommerce PDF Invoices CVE-2026-111578

Exploitation requires the WooCommerce store to accept guest orders (a common default for retail stores) so an unauthenticated user can submit the billing address, shipping address, or customer order note fields that are rendered unescaped by the plugin's invoice/packing-slip document generation (plugin versions 5.16.2 up to before 5.16.5). The payload is inert until a shop administrator opens the generated invoice or packing-slip document - this required administrator interaction (UI:R) is the primary limiting factor, meaning the attacker cannot control execution timing and exploitation is not fully automatable. Stores that disable guest checkout or are not running an affected version are not exposed by this path.

This is a stored Cross-Site Scripting flaw in the PDF Invoices & Packing Slips for WooCommerce plugin (versions 5.16.2 up to, but not including, 5.16.5). The supplied CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H, score 7.5) indicates a network-reachable, unauthenticated issue (PR:N) that still requires administrator interaction (UI:R) - the injected script only fires when a shop administrator opens the generated invoice or packing-slip document. The decision label is 'this_week' (vuln.today priority), not act_now or emergency. There is NO CISA KEV listing and NO EPSS score provided, so no quantitative exploitation-probability or active-exploitation signal is available; absence of these is not evidence of safety but should not be read as active exploitation either. A PoC reference exists (WPScan/cveorg) but it is not verified as working exploit code. Signals are therefore mildly conflicting: the injection path is trivially reachable by any guest placing an order (favoring higher real-world risk), but exploitation depends on an administrator later viewing the malicious document (a meaningful limiter). The input's AC:H is questionable - crafting a guest order with a malicious field is low-complexity; the real friction is the UI:R admin-view requirement, not attack complexity. The impact metrics C:H/I:H/A:H reflect the assumption that script execution in the authenticated admin context enables account/session takeover; this is plausible for admin-targeted stored XSS but is an inference, not a confirmed consequence. Net: a genuine, worth-patching issue given the unauthenticated injection and popular plugin, but not an emergency given admin-view dependence, no KEV, and an unverified PoC.

An unauthenticated attacker places a guest order in the WooCommerce store and inserts a malicious JavaScript payload into a billing/shipping address field or the customer order note. The values are stored and later rendered without proper escaping in the generated invoice or packing-slip document; when a shop administrator opens that document, the script executes in the administrator's authenticated browser context. A public PoC reference exists but is not verified as working exploit code.