CVE-2026-109217

Rejected reason: This CVE ID was reserved for a reported issue in the PDF Invoices & Packing Slips for WooCommerce WordPress plugin and was never published. On validation the reported behaviour was determined not to be a vulnerability: the Shop Manager role that could invoke the bulk invoice deletion and renumbering tool already holds the equivalent capability through the plugin's normal per-order invoice controls and through WooCommerce order management, so it crosses no privilege boundary. No CVE record should reference this ID.

The PDF Invoices & Packing Slips for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Billing First Name / Last Name / Company Fields in all versions up to, and including, 5.16.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload survives initial storage because WooCommerce's sanitize_text_field() and wc_clean() do not strip entity-encoded strings containing no literal '<' character, allowing unauthenticated guest-checkout orders to plant the malicious content.

The PDF Invoices & Packing Slips for WooCommerce plugin is vulnerable to Stored Cross-Site Scripting via the 'billing_address.first_name / last_name / company, customer_note' parameters in versions up to 5.16.4 due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts that execute when a user visits an injected page. This is an incomplete fix for CVE-2026-92244: the wp_kses() allow-list introduced in 5.16.2 correctly blocks raw-tag payloads but is bypassed by entity-encoded payloads (e.g., &lt;img onerror=…&gt;) that contain no literal angle-bracket characters and are therefore passed through unmodified before the trailing decode rematerializes them.

The PDF Invoices & Packing Slips for WooCommerce WordPress plugin from 5.16.2 before 5.16.5 does not properly escape several customer-supplied order fields (billing and shipping address values and the customer order note) before outputting them in generated invoice and packing-slip documents. This allows unauthenticated users placing guest orders to store a malicious script that executes when a shop administrator views the document, leading to Stored Cross-Site Scripting.

The PDF Invoices & Packing Slips for WooCommerce plugin for WordPress up to version 5.14.0 is vulnerable to Insecure Direct Object Reference (IDOR) in the generate_document_shortcode. Missing validation on a user-controlled key allows authenticated attackers with contributor-level access or higher to generate publicly accessible download links for arbitrary third-party orders, exposing sensitive customer data.