---
id: CVE-2026-111578
title: >-
  PDF Invoices & Packing Slips for WooCommerce 5.16.2 - 5.16.4 - Unauthenticated
  Stored XSS via Order Address and Customer Note Fields
summary: >-
  The PDF Invoices & Packing Slips for WooCommerce WordPress plugin from 5.16.2
  before 5.16.5 does not properly escape several customer-supplied order fields
  — including the billing and shipping address values and the customer order
  note —…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H'
cvssSource: cna
cwe:
  - CWE-79
product: PDF Invoices & Packing Slips for WooCommerce
affected:
  - pdf_invoices_packing_slips_for_woocommerce >= 5.16.2 < 5.16.5
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-31T00:53:14.678123Z'
published: '2026-10-30'
updated: '2026-10-31'
sourceUpdated: '2026-10-31T00:53:29.904Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-111578'
references:
  - url: 'https://wpscan.com/vulnerability/ac5d0074-295d-46ee-b2ad-8bfd3ef9917b/'
tags:
  - cve.org
epss: 0.00298
epssPercentile: 0.2261
ingestedAt: '2026-11-05T16:24:31.494Z'
---

## Overview

The PDF Invoices & Packing Slips for WooCommerce WordPress plugin from 5.16.2 before 5.16.5 does not properly escape several customer-supplied order fields — including the billing and shipping address values and the customer order note — before they are output in generated invoice and packing-slip documents, allowing unauthenticated users placing guest orders to store a malicious script that executes when a shop administrator views the document, leading to Stored Cross-Site Scripting.

## Affected

- `pdf_invoices_packing_slips_for_woocommerce >= 5.16.2 < 5.16.5`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.