WordPress PDF Invoices & Packing Slips for WooCommerce plugin 5.16.2-5.16.4 - Unauthenticated Stored XSS vulnerability

Unauthenticated Stored XSS vulnerability discovered by Karthik Ramakrishnan in WordPress Plugin WooCommerce PDF Invoices & Packing Slips versions 5.16.2-5.16.4...

CVE-2026-109217

The PDF Invoices & Packing Slips for WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.16.5 via the 'invoicenumber via document filename' parameter. This makes it possible for unauthenticated attackers to extract another...

CVE-2026-107750

The PDF Invoices & Packing Slips for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'billingaddress.firstname / lastname / company, customernote' parameter in all versions up to, and including, 5.16.4 due to insufficient input sanitization and output escapin...

CVE-2026-109217 PDF Invoices & Packing Slips for WooCommerce <= 5.16.5 - Unauthenticated Sensitive Information Exposure via Yearly-Reset Invoice Attachment Cache

The PDF Invoices & Packing Slips for WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.16.5 via the 'invoicenumber via document filename' parameter. This makes it possible for unauthenticated attackers to extract another...

CVE-2026-109217

The PDF Invoices & Packing Slips for WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to and including 5.16.5 . The vulnerability exists in the 'invoice_number (via document filename)' parameter, which can allow unauthenticated attackers to extra...

EUVD-2026-114613

The PDF Invoices & Packing Slips for WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.16.5 via the 'invoicenumber via document filename' parameter. This makes it possible for unauthenticated attackers to extract another...

CVE-2026-109217 PDF Invoices & Packing Slips for WooCommerce <= 5.16.5 - Unauthenticated Sensitive Information Exposure via Yearly-Reset Invoice Attachment Cache

The PDF Invoices & Packing Slips for WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.16.5 via the 'invoicenumber via document filename' parameter. This makes it possible for unauthenticated attackers to extract another...

CVE-2026-107750

The PDF Invoices & Packing Slips for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 5.16.4 . The vulnerability exists in the billing_address.first_name, last_name, company, and customer_note parameters due to insufficient in...

EUVD-2026-114607

The PDF Invoices & Packing Slips for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'billingaddress.firstname / lastname / company, customernote' parameter in all versions up to, and including, 5.16.4 due to insufficient input sanitization and output escapin...

CVE-2026-107750 PDF Invoices & Packing Slips for WooCommerce <= 5.16.4 - Unauthenticated Stored Cross-Site Scripting via Billing First Name / Last Name / Company / Customer Note fields at guest checkout

The PDF Invoices & Packing Slips for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'billingaddress.firstname / lastname / company, customernote' parameter in all versions up to, and including, 5.16.4 due to insufficient input sanitization and output escapin...

CVE-2026-107750 PDF Invoices & Packing Slips for WooCommerce <= 5.16.4 - Unauthenticated Stored Cross-Site Scripting via Billing First Name / Last Name / Company / Customer Note fields at guest checkout

The PDF Invoices & Packing Slips for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'billingaddress.firstname / lastname / company, customernote' parameter in all versions up to, and including, 5.16.4 due to insufficient input sanitization and output escapin...

EUVD-2026-114514

The PDF Invoices & Packing Slips for WooCommerce WordPress plugin from 5.16.2 before 5.16.5 does not properly escape several customer-supplied order fields — including the billing and shipping address values and the customer order note — before they are output in generated invoice and packing-sli...

CVE-2026-109217: wpovernight PDF Invoices & Packing Slips for WooCommerce: The PDF Invoices & Packing Slips for WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure…

The PDF Invoices & Packing Slips for WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.16.5 via the 'invoicenumber via document filename' parameter. This makes it possible for unauthenticated attackers to extract another...

PT-2026-134441

Name of the Vulnerable Software and Affected Versions PDF Invoices & Packing Slips for WooCommerce versions prior to 5.16.6 Description An issue exists that allows unauthenticated attackers to extract a different customer's complete invoice PDF. This exposure includes billing identity, shipping...

CVE-2026-107750: wpovernight PDF Invoices & Packing Slips for WooCommerce: The PDF Invoices & Packing Slips for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via…

The PDF Invoices & Packing Slips for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'billingaddress.firstname / lastname / company, customernote' parameter in all versions up to, and including, 5.16.4 due to insufficient input sanitization and output escapin...

CVE-2026-111578

The PDF Invoices & Packing Slips for WooCommerce WordPress plugin from 5.16.2 before 5.16.5 does not properly escape several customer-supplied order fields — including the billing and shipping address values and the customer order note — before they are output in generated invoice and packing-sli...

CVE-2026-111578 PDF Invoices & Packing Slips for WooCommerce 5.16.2 - 5.16.4 - Unauthenticated Stored XSS via Order Address and Customer Note Fields

The PDF Invoices & Packing Slips for WooCommerce WordPress plugin from 5.16.2 before 5.16.5 does not properly escape several customer-supplied order fields — including the billing and shipping address values and the customer order note — before they are output in generated invoice and packing-sli...

CVE-2026-111578 PDF Invoices & Packing Slips for WooCommerce 5.16.2 - 5.16.4 - Unauthenticated Stored XSS via Order Address and Customer Note Fields

The PDF Invoices & Packing Slips for WooCommerce WordPress plugin from 5.16.2 before 5.16.5 does not properly escape several customer-supplied order fields — including the billing and shipping address values and the customer order note — before they are output in generated invoice and packing-sli...

CVE-2026-111578

The PDF Invoices & Packing Slips for WooCommerce WordPress plugin (versions 5.16.2 through 5.16.4 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is the failure to properly escape customer-supplied order fields—specifically billing and shipping address values and customer or...

WordPress PDF Invoices & Packing Slips for WooCommerce plugin <= 5.16.4 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by churchill11 in WordPress Plugin WooCommerce PDF Invoices & Packing Slips versions = 5.16.4...