Pdf Invoices Packing Slips For Woocommerce
Monthly
Stored cross-site scripting in the WooCommerce PDF Invoices & Packing Slips plugin (versions up to and including 5.16.4) allows an unauthenticated attacker to plant entity-encoded script payloads through the public checkout's billing first name, last name, company and customer note fields, which then execute in a shop staff or administrator's browser when that privileged user opens the generated invoice, packing slip or order document - so the assessed vector requires user interaction (UI:R) despite the input CVSS listing UI:N. The flaw is an incomplete fix for CVE-2026-92244: the wp_kses() allow-list added in 5.16.2 rejects payloads containing literal angle brackets, but entity-encoded payloads such as <img onerror=…> pass through unmodified and are rematerialized when decoded downstream. No public exploit code is confirmed at time of analysis; the vendor fix appears as changeset 3756047 on the plugin trunk, and the vendor advisory is linked from the Wordfence threat-intel record.
Stored cross-site scripting in the PDF Invoices & Packing Slips for WooCommerce plugin (5.16.2 up to, but not including, 5.16.5) allows unauthenticated guest shoppers to persist malicious script in billing address, shipping address, or customer order-note fields, which executes when a shop administrator views a generated invoice or packing slip. The assessed vector requires administrator interaction (UI:R), so execution timing is not attacker-controlled and exploitation is not fully automatable; stores that disable guest checkout are not exposed by this path. A public PoC reference exists; it is not verified as working exploit code, and no KEV active-exploitation status is supplied.
Stored cross-site scripting in the PDF Invoices & Packing Slips for WooCommerce plugin (all versions up to and including 5.16.1) allows an unauthenticated attacker to inject arbitrary JavaScript into a WooCommerce order by way of the Billing First Name, Last Name, or Company fields, which are insufficiently sanitized on input and unescaped on output. Because guest checkout is enabled by default on most storefronts, no account or authentication is required to plant the payload; however, the injected script only executes when a privileged user later views the affected order, invoice, or plugin settings page in the WordPress admin context, so a victim must interact with the poisoned record. There is no evidence of confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis; a vendor fix ships in version 5.16.2.
Sensitive information exposure in WP Overnight's PDF Invoices & Packing Slips for WooCommerce (all versions through 5.16.5) can deliver another customer's complete invoice PDF - billing identity, shipping address, private order notes, line items, prices, order dates, order ID and invoice number - as an attachment on an order-confirmation email the attacker receives. Exploitation is gated by two preconditions: the store must have enabled the plugin's non-default yearly invoice-number reset, and the attacker's own guest-checkout order must fire a 'processing' email within a 60-second window of a victim order carrying the same reset invoice number. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV; the raw CVSS of 5.3 overstates practical risk, since the assessed vector is AC:H with confidentiality impact limited to a single colliding document, and reliable large-scale exploitation is impractical given the timing race and configuration dependency.
Insecure Direct Object Reference in the PDF Invoices & Packing Slips for WooCommerce plugin (versions through 5.14.0) allows authenticated contributors to mint permanent, session-free download links for arbitrary third-party orders, exposing customer PII including names, billing and shipping addresses, email addresses, phone numbers, line items, payment details, and customer notes. Exploitation is gated on a non-default plugin setting - the 'Document link access type' must be configured to 'full' rather than the default 'logged_in'; the default configuration signs URLs with a per-session nonce, neutralising the attack path. No public exploit code or active exploitation has been identified at time of analysis.
Stored cross-site scripting in the WooCommerce PDF Invoices & Packing Slips plugin (versions up to and including 5.16.4) allows an unauthenticated attacker to plant entity-encoded script payloads through the public checkout's billing first name, last name, company and customer note fields, which then execute in a shop staff or administrator's browser when that privileged user opens the generated invoice, packing slip or order document - so the assessed vector requires user interaction (UI:R) despite the input CVSS listing UI:N. The flaw is an incomplete fix for CVE-2026-92244: the wp_kses() allow-list added in 5.16.2 rejects payloads containing literal angle brackets, but entity-encoded payloads such as <img onerror=…> pass through unmodified and are rematerialized when decoded downstream. No public exploit code is confirmed at time of analysis; the vendor fix appears as changeset 3756047 on the plugin trunk, and the vendor advisory is linked from the Wordfence threat-intel record.
Stored cross-site scripting in the PDF Invoices & Packing Slips for WooCommerce plugin (5.16.2 up to, but not including, 5.16.5) allows unauthenticated guest shoppers to persist malicious script in billing address, shipping address, or customer order-note fields, which executes when a shop administrator views a generated invoice or packing slip. The assessed vector requires administrator interaction (UI:R), so execution timing is not attacker-controlled and exploitation is not fully automatable; stores that disable guest checkout are not exposed by this path. A public PoC reference exists; it is not verified as working exploit code, and no KEV active-exploitation status is supplied.
Stored cross-site scripting in the PDF Invoices & Packing Slips for WooCommerce plugin (all versions up to and including 5.16.1) allows an unauthenticated attacker to inject arbitrary JavaScript into a WooCommerce order by way of the Billing First Name, Last Name, or Company fields, which are insufficiently sanitized on input and unescaped on output. Because guest checkout is enabled by default on most storefronts, no account or authentication is required to plant the payload; however, the injected script only executes when a privileged user later views the affected order, invoice, or plugin settings page in the WordPress admin context, so a victim must interact with the poisoned record. There is no evidence of confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis; a vendor fix ships in version 5.16.2.
Sensitive information exposure in WP Overnight's PDF Invoices & Packing Slips for WooCommerce (all versions through 5.16.5) can deliver another customer's complete invoice PDF - billing identity, shipping address, private order notes, line items, prices, order dates, order ID and invoice number - as an attachment on an order-confirmation email the attacker receives. Exploitation is gated by two preconditions: the store must have enabled the plugin's non-default yearly invoice-number reset, and the attacker's own guest-checkout order must fire a 'processing' email within a 60-second window of a victim order carrying the same reset invoice number. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV; the raw CVSS of 5.3 overstates practical risk, since the assessed vector is AC:H with confidentiality impact limited to a single colliding document, and reliable large-scale exploitation is impractical given the timing race and configuration dependency.
Insecure Direct Object Reference in the PDF Invoices & Packing Slips for WooCommerce plugin (versions through 5.14.0) allows authenticated contributors to mint permanent, session-free download links for arbitrary third-party orders, exposing customer PII including names, billing and shipping addresses, email addresses, phone numbers, line items, payment details, and customer notes. Exploitation is gated on a non-default plugin setting - the 'Document link access type' must be configured to 'full' rather than the default 'logged_in'; the default configuration signs URLs with a per-session nonce, neutralising the attack path. No public exploit code or active exploitation has been identified at time of analysis.