CVE-2026-107750

The PDF Invoices & Packing Slips for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'billingaddress.firstname / lastname / company, customernote' parameter in all versions up to, and including, 5.16.4 due to insufficient input sanitization and output escapin...

CVE-2026-107750

The PDF Invoices & Packing Slips for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 5.16.4 . The vulnerability exists in the billing_address.first_name, last_name, company, and customer_note parameters due to insufficient in...

CVE-2026-107750 PDF Invoices & Packing Slips for WooCommerce <= 5.16.4 - Unauthenticated Stored Cross-Site Scripting via Billing First Name / Last Name / Company / Customer Note fields at guest checkout

The PDF Invoices & Packing Slips for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'billingaddress.firstname / lastname / company, customernote' parameter in all versions up to, and including, 5.16.4 due to insufficient input sanitization and output escapin...

EUVD-2026-114607

The PDF Invoices & Packing Slips for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'billingaddress.firstname / lastname / company, customernote' parameter in all versions up to, and including, 5.16.4 due to insufficient input sanitization and output escapin...

CVE-2026-107750 PDF Invoices & Packing Slips for WooCommerce <= 5.16.4 - Unauthenticated Stored Cross-Site Scripting via Billing First Name / Last Name / Company / Customer Note fields at guest checkout

The PDF Invoices & Packing Slips for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'billingaddress.firstname / lastname / company, customernote' parameter in all versions up to, and including, 5.16.4 due to insufficient input sanitization and output escapin...

CVE-2026-107750: wpovernight PDF Invoices & Packing Slips for WooCommerce: The PDF Invoices & Packing Slips for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via…

The PDF Invoices & Packing Slips for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'billingaddress.firstname / lastname / company, customernote' parameter in all versions up to, and including, 5.16.4 due to insufficient input sanitization and output escapin...

CVE-2026-103367

The ShopMagic – email automation for WordPress plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.9.0 via the 'billingaddress.firstname' parameter parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary .php...

CVE-2026-103367 ShopMagic <= 4.9.0 - Unauthenticated Local File Inclusion via 'billing.first_name' Parameter

The ShopMagic – email automation for WordPress plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.9.0 via the 'billingaddress.firstname' parameter parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary .php...

CVE-2026-103367 ShopMagic <= 4.9.0 - Unauthenticated Local File Inclusion via 'billing.first_name' Parameter

The ShopMagic – email automation for WordPress plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.9.0 via the 'billingaddress.firstname' parameter parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary .php...

EUVD-2026-100903

The ShopMagic – email automation for WordPress plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.9.0 via the 'billingaddress.firstname' parameter parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary .php...

CVE-2026-103367

The ShopMagic – email automation for WordPress plugin is vulnerable to an Unauthenticated Local File Inclusion (LFI) in all versions up to and including 4.9.0 . The vulnerability exists via the billing_address.first_name parameter, where a lack of proper input sanitization allows attackers to inc...

CVE-2026-103367: Improper Control of Filename for Include/Require Statement in PHP Program

The ShopMagic – email automation for WordPress plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.9.0 via the 'billingaddress.firstname' parameter parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary .php...