CVE-2026-111593

The PDF Invoices & Packing Slips for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Billing First Name / Last Name / Company Fields in all versions up to, and including, 5.16.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload survives initial storage because WooCommerce's sanitize_text_field() and wc_clean() do not strip entity-encoded strings containing no literal '<' character, allowing unauthenticated guest-checkout orders to plant the malicious content.

The PDF Invoices & Packing Slips for WooCommerce plugin is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.16.5 via the 'invoice_number' parameter (via document filename). Unauthenticated attackers can extract another customer's complete invoice PDF, including billing identity, shipping address, private order notes, line items, prices, dates, order ID, and invoice number, delivered directly to the attacker's email as an order confirmation attachment.

The PDF Invoices & Packing Slips for WooCommerce plugin is vulnerable to Stored Cross-Site Scripting via the 'billing_address.first_name / last_name / company, customer_note' parameters in versions up to 5.16.4 due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts that execute when a user visits an injected page. This is an incomplete fix for CVE-2026-92244: the wp_kses() allow-list introduced in 5.16.2 correctly blocks raw-tag payloads but is bypassed by entity-encoded payloads (e.g., &lt;img onerror=…&gt;) that contain no literal angle-bracket characters and are therefore passed through unmodified before the trailing decode rematerializes them.

The PDF Invoices & Packing Slips for WooCommerce WordPress plugin from 5.16.2 before 5.16.5 does not properly escape several customer-supplied order fields (billing and shipping address values and the customer order note) before outputting them in generated invoice and packing-slip documents. This allows unauthenticated users placing guest orders to store a malicious script that executes when a shop administrator views the document, leading to Stored Cross-Site Scripting.

The PDF Invoices & Packing Slips for WooCommerce plugin for WordPress up to version 5.14.0 is vulnerable to Insecure Direct Object Reference (IDOR) in the generate_document_shortcode. Missing validation on a user-controlled key allows authenticated attackers with contributor-level access or higher to generate publicly accessible download links for arbitrary third-party orders, exposing sensitive customer data.