rootpwn

high · CVSS v3 7.2

CVE-2026-92244

The PDF Invoices & Packing Slips plugin for WooCommerce is vulnerable to stored cross‑site scripting via billing fields. Unauthenticated use

Overview

The PDF Invoices & Packing Slips plugin for WooCommerce is vulnerable to stored cross‑site scripting via billing fields. Unauthenticated users can inject scripts that execute when any user views an invoice. This can lead to session hijacking, defacement, or data theft.

Description

The PDF Invoices & Packing Slips for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Billing First Name / Last Name / Company Fields in all versions up to, and including, 5.16.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload survives initial storage because WooCommerce's sanitize_text_field() and wc_clean() do not strip entity-encoded strings containing no literal '<' character, allowing unauthenticated guest-checkout orders to plant the malicious content.

Impact

Confidentiality: attackers can steal session cookies or other sensitive data. Integrity: malicious scripts can alter invoice content or inject malware. Availability: minimal direct impact. Defenders: site administrators, developers, and end users are affected.

Remediation

Update the plugin to version 5.16.2 or later. If an update is not possible, sanitize billing fields on input or disable guest checkout. Implement a Content Security Policy that blocks inline scripts and restricts script sources.

Risk context

High severity (CVSS 7.2) with no EPSS data. Attackers can exploit this flaw without authentication, so prompt patching is recommended.

Affected products

  • WooCommerce PDF Invoices & Packing Slips
  • WordPress

Scores

Severity
high
CVSS v2
6.4
CVSS v3
7.2
CVSS v4
—
EPSS
—

XSS WooCommerce PDF Stored XSS WordPress Guest Checkout Input Sanitization

← All CVEs

Related CVEs

high

CVE-2026-104912

MISP before v2.5.48 has an authorization flaw in correlation handling during attribute searches. Correlated attributes and events can be authorized using a stale distribution snapshot instead of the live event access control list. This matters because restricted or unpublished events may remain visible to authenticated users who no longer have permission.

View analysis

high

CVE-2026-94544

CVE-2026-94544 exposes a cache sharing flaw in Next.js 16.3.0‑16.3.8 that allows unauthenticated users to see unpublished draft content or see published content in draft mode. The vulnerability arises when Cache Components or experimental.useCache are enabled and cached functions return draft‑dependent data. It can lead to accidental disclosure of sensitive content on public sites.

View analysis

high

CVE-2026-94591

Armatura One stores database and message‑broker credentials in an install configuration file encrypted with AES‑128‑CBC. The encryption key and IV are hard‑coded and identical across all installations, allowing an attacker who obtains the installation package to decrypt any configuration file. This flaw can expose critical credentials used to access the database and broker.

View analysis

high

CVE-2026-94592

Armatura One's database initialization uses a fixed vendor password for the superuser, allowing anyone with OS access to log in as the database administrator. This flaw can lead to full database compromise on installations where the default password remains unchanged. It is critical for deployments to change the superuser password immediately.

View analysis