CVE-2026-111578

The PDF Invoices & Packing Slips for WooCommerce WordPress plugin (versions 5.16.2 through 5.16.4 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is the failure to properly escape customer-supplied order fields—specifically billing and shipping address values and customer or...

CVE-2026-111578 PDF Invoices & Packing Slips for WooCommerce 5.16.2 - 5.16.4 - Unauthenticated Stored XSS via Order Address and Customer Note Fields

The PDF Invoices & Packing Slips for WooCommerce WordPress plugin from 5.16.2 before 5.16.5 does not properly escape several customer-supplied order fields — including the billing and shipping address values and the customer order note — before they are output in generated invoice and packing-sli...