CVE-2026-109220

The PDF Invoice for WooCommerce + Drag and Drop Template Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to and including 7.1.1 . The root cause is insufficient sanitization of the customer_note checkout field, which is inlined into invoice HTML, decoded by s...