Stored XSS in PDF Invoices & Packing Slips for WooCommerce plugin
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- High
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-79.
Summary
The PDF Invoices & Packing Slips for WooCommerce WordPress plugin from 5.16.2 before 5.16.5 does not escape customer-supplied order fields, including billing and shipping address values and the customer order note, before they appear in generated invoices and packing slips. An unauthenticated user placing a guest order can store a malicious script that runs when a shop administrator views the document (CWE-79). An exploit link is listed in the references.
Written with Claude Haiku 5.5 from the sources below · 2026-11-05
Description from the CNA
The PDF Invoices & Packing Slips for WooCommerce WordPress plugin from 5.16.2 before 5.16.5 does not properly escape several customer-supplied order fields — including the billing and shipping address values and the customer order note — before they are output in generated invoice and packing-slip documents, allowing unauthenticated users placing guest orders to store a malicious script that executes when a shop administrator views the document, leading to Stored Cross-Site Scripting.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Unknown | PDF Invoices & Packing Slips for WooCommerce | 5.16.2 to before 5.16.5 | 5.16.5 | Patch available | CNA |
- PDF Invoices & Packing Slips for WooCommerce VendorUnknown Affected 5.16.2 to before 5.16.5 Fixed in 5.16.5 Patch available CNA
Remediation
Update the plugin to version 5.16.5, the fixed version listed in the sources.
Written with Claude Haiku 5.5 from the sources below · 2026-11-05
- Fix · CNA PDF Invoices & Packing Slips for WooCommerce (Unknown) Fixed in 5.16.5
Timeline
- 2026-10-30 Threatist record created from CVE-2026-111578
- 2026-10-31 Weakness changed · CISA ADP
- 2026-10-31 CISA SSVC decision points changed
- 2026-10-31 Priority changed: MEDIUM → LOW
- 2026-10-31 Alias added: GHSA-xq56-qcfx-62xr
References
Sources
- CVE-2026-111578 · CVE Program
- CVE-2026-111578 · NVD
- FIRST EPSS
- GHSA-xq56-qcfx-62xr · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences