CVE-2026-92244 in PDF Invoices & Packing Slips for WooCommerce Plugin
Summary
by MITRE • 10/01/2026
The PDF Invoices & Packing Slips for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Billing First Name / Last Name / Company Fields in all versions up to, and including, 5.16.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload survives initial storage because WooCommerce's sanitize_text_field() and wc_clean() do not strip entity-encoded strings containing no literal '<' character, allowing unauthenticated guest-checkout orders to plant the malicious content.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/01/2026
The vulnerability identified in the PDF Invoices & Packing Slips for WordPress plugin represents a significant security risk within the WooCommerce ecosystem, specifically affecting versions up through 5.16.1. This flaw is classified as a Stored Cross-Site Scripting (XSS) vulnerability, which falls under CWE-79 in the Common Weakness Enumeration standard. The core issue stems from insufficient input sanitization and output escaping mechanisms when handling user-provided data during the checkout process. Unlike reflected XSS attacks that require an attacker to trick a victim into clicking a malicious link, stored XSS persists on the target server, making it more dangerous as every subsequent view of the affected content triggers the execution of the injected script without further interaction from the attacker.
The technical mechanism behind this vulnerability involves the specific fields used during WooCommerce guest checkout: Billing First Name, Last Name, and Company. When an unauthenticated user submits these fields to place a test or actual order, the plugin processes this data for inclusion in generated PDF invoices and packing slips. The sanitization functions employed by WooCommerce, specifically sanitize_text_field() and wc_clean(), are designed primarily to strip HTML tags that contain literal less-than characters. However, they fail to adequately handle entity-encoded strings that do not contain these literal delimiters. This oversight allows attackers to bypass standard filtering routines by encoding malicious JavaScript payloads in a manner that evades detection while remaining executable within the browser context of users who view the generated documents or related web pages where this data is rendered without proper escaping.
From an operational perspective, the impact of this vulnerability extends beyond simple script execution. An unauthenticated attacker can inject arbitrary web scripts into the system by simply placing a test order with malicious content in the billing fields. Because WooCommerce allows guest checkouts without requiring authentication, the barrier to entry for exploitation is effectively zero. Once stored, the payload survives initial processing and becomes part of the persistent data set associated with that transaction. When an administrator or customer accesses the invoice PDF generation interface or views the order details where this information is displayed in a web context, the browser interprets the entity-encoded script as executable code. This can lead to session hijacking, credential theft via keyloggers, defacement of administrative interfaces, or redirection to phishing sites, thereby compromising the integrity and confidentiality of the e-commerce platform.
This vulnerability aligns with MITRE ATT&CK technique T1059.007, which covers JavaScript execution within web browsers, specifically in the context of stored payloads that persist on a server-side application. The attack vector leverages the trust users place in legitimate administrative and customer-facing pages to deliver malicious code silently. The persistence is achieved through the database storage of order details, meaning the threat remains active until the vulnerable data is purged or the plugin is updated. This creates a long-term risk profile where even after an initial compromise attempt fails due to lack of immediate victim interaction, the planted payload continues to pose a threat to any future viewer of the affected records.
Mitigation strategies must focus on both immediate remediation and long-term defensive coding practices. The primary solution is to update the PDF Invoices & Packing Slips plugin to version 5.16.2 or later, where these sanitization issues have been addressed by developers implementing stricter output escaping for all user-supplied data rendered in HTML contexts. Administrators should also ensure that any custom code interacting with WooCommerce checkout fields implements robust input validation and output encoding consistent with OWASP guidelines. Additionally, deploying a Web Application Firewall (WAF) can provide an additional layer of defense by detecting and blocking attempts to inject script tags or encoded variants thereof during the request phase. Regular security audits focusing on data flow from user inputs to database storage and subsequent rendering are essential to prevent similar vulnerabilities in other plugins that interact with WooCommerce order data.