EUVD-2026-90564
GHSA-v7w7-gmmm-67f2
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Unauthenticated network injection via guest checkout (PR:N), but execution requires an admin to view the injected page (UI:R); stored XSS crossing into admin context is a scope change with limited C/I impact.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
3DescriptionCVE.org
The PDF Invoices & Packing Slips for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Billing First Name / Last Name / Company Fields in all versions up to, and including, 5.16.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload survives initial storage because WooCommerce's sanitize_text_field() and wc_clean() do not strip entity-encoded strings containing no literal '<' character, allowing unauthenticated guest-checkout orders to plant the malicious content.
AnalysisAI
Stored cross-site scripting in the PDF Invoices & Packing Slips for WooCommerce plugin (all versions up to and including 5.16.1) allows an unauthenticated attacker to inject arbitrary JavaScript into a WooCommerce order by way of the Billing First Name, Last Name, or Company fields, which are insufficiently sanitized on input and unescaped on output. Because guest checkout is enabled by default on most storefronts, no account or authentication is required to plant the payload; however, the injected script only executes when a privileged user later views the affected order, invoice, or plugin settings page in the WordPress admin context, so a victim must interact with the poisoned record. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the target site to run the PDF Invoices & Packing Slips for WooCommerce plugin (version 5.16.1 or earlier) alongside WooCommerce with guest checkout enabled, which is the default for most storefronts. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N = 7.2 High) describes a network-exploitable, low-complexity, unauthenticated stored XSS with a scope change, reflecting that a guest attacker injects a payload stored in one component (the order record) that later executes in a different security context (the WordPress admin/invoice rendering context). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: upgrade PDF Invoices & Packing Slips for WooCommerce to version 5.16.2 or later, available through the WordPress plugin repository and the vendor's update channel; the 5.16.1-to-5.16.2 changeset is documented at https://plugins.trac.wordpress.org/changeset?reponame=&new=3707106%40woocommerce-pdf-invoices-packing-slips%2Ftags%2F5.16.2&old=3658456%40woocommerce-pdf-invoices-packing-slips%2Ftags%2F5.16.1, and the originating advisory is at https://www.wordfence.com/threat-intel/vulnerabilities/id/2ec3bd67-6e4b-46b6-8027-feeea149f3a4?source=cve. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Vendor-released patch: 5.16.2 is available; update the PDF Invoices & Packing Slips for WooCommerce plugin to version 5.16.2 or later within 24 hours. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Woocommerce
View allThe WooCommerce plugin through 3.x for WordPress has a Directory Traversal Vulnerability via a /wp-content/plugins/wooco
The WooCommerce Help Scout WordPress plugin before 2.9.1 (https://woocommerce.com/products/woocommerce-help-scout/) allo
WooCommerce 7.1.0 contains a remote code execution vulnerability that allows attackers to execute arbitrary PHP code by
Ultimate WooCommerce Gift Cards 3.0.2 is affected by a file upload vulnerability in the Custom GiftCard Template that ca
Unauthenticated SQL injection in the ELEX WooCommerce Request a Quote WordPress plugin (all versions before 2.4.1) allow
Unauthenticated, network-reachable attackers can read the WooCommerce API consumer key and secret stored by the MgoSync
Unauth. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low atta
An issue was discovered in the NAB Transact extension 2.1.0 for the WooCommerce plugin for WordPress. Rated high severit
Privilege escalation in MultiVendorX WordPress plugin before 5.0.16 allows authenticated vendor-role users to grant admi
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Automattic WooComm
Unauthenticated information disclosure in the Geliver Akıllı Kargo Pazaryeri WordPress plugin (versions 3.0.0 through 3.
Authenticated attackers with only Subscriber-level access can mint wallet funds for themselves or drain a specific victi
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today