WooCommerce PDF Invoices EUVD-2026-114607

The attacker must be able to submit a WooCommerce order via the public checkout (default behavior for an operational store) running the plugin version 5.16.2 through 5.16.4, where the wp_kses() allow-list was introduced. The specific trigger is an entity-encoded payload (no literal angle brackets, e.g. <img onerror=…>) placed in billing_address.first_name, last_name, company, or the customer_note field; these fields bypass the allow-list because they contain no raw tags and are decoded downstream. Exploitation is limited by the requirement that a privileged user (shop admin/staff) subsequently open the affected order document (PDF invoice, packing slip, or order view) for the script to execute - payloads do not auto-execute without that view. Stores on a version before 5.16.2 (no allow-list) or after the remediated release fall outside this specific entity-encoding bypass.

The input CVSS is 7.2 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N), driven by network reach, no privileges and no user interaction, with a scope change reflecting that the injected script executes in a different security context (shop staff/admin browser). However, the mechanism described - a stored payload that fires 'whenever a user accesses an injected page' such as a generated PDF invoice or order view - implies a privileged user must open the affected document. That is effectively user interaction (UI:R), which would lower the score to ~6.1; the UI:N in the supplied vector is debatable for this stored-XSS pattern. No CISA KEV entry is present, so this is not confirmed as actively exploited. No EPSS score was provided, so exploitation probability cannot be quantified from the input. No PoC or exploit reference is listed (the references are the Wordfence advisory and plugin source on WordPress.org trac), so there is no public exploit identified at time of analysis. The vuln.today decision label is 'this_week', consistent with a real but non-emergency priority. A notable aggravating factor: this is explicitly an incomplete fix for CVE-2026-92244 - the wp_kses() allow-list added in 5.16.2 blocks raw-tag payloads but is bypassed by entity-encoded payloads, meaning the attack surface is already documented and the bypass is simple, which tends to raise the real likelihood of weaponization. Combined with a widely deployed plugin, this is a genuine this-week patching priority rather than a purely theoretical high-CVSS issue, but it is not emergency-grade given the privileged-view requirement, absent KEV, and missing EPSS.

An unauthenticated attacker places a WooCommerce order through the public checkout, entering an entity-encoded script payload (e.g., <img onerror=…>) into the billing first/last name, company, or customer-note field. Because the payload contains no literal angle brackets, it passes the wp_kses() allow-list unchanged and is re-materialized on a later decode; when a shop administrator or staff member opens the order's PDF invoice, packing slip, or order view, the script executes in their authenticated session. No public PoC is referenced in the provided data.