PDF Invoices & Packing Slips for WooCommerce 5.16.2 - 5.16.4 - Unauthenticated Stored XSS via Order Address and Customer Note Fields
Affects PDF Invoices & Packing Slips for WooCommerce versions 5.16.2 through 5.16.4, where guest-order address and order note fields are output unescaped. Fixed in 5.16.5.
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Specific setups only
- Fix
- Fixed in 5.16.5
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: none
- Automatable: no
- Technical impact: total
Summary
The PDF Invoices & Packing Slips plugin for WooCommerce, a WordPress extension used by online stores, is affected. An attacker placing a guest order can insert malicious script through address or order note fields, which runs in the browser of a shop administrator when they view the generated invoice or packing slip.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
The PDF Invoices & Packing Slips for WooCommerce WordPress plugin from 5.16.2 before 5.16.5 does not properly escape several customer-supplied order fields — including the billing and shipping address values and the customer order note — before they are output in generated invoice and packing-slip documents, allowing unauthenticated users placing guest orders to store a malicious script that executes when a shop administrator views the document, leading to Stored Cross-Site Scripting.
Timeline
- CVE published
- First seen by cve.now1 day
- CISA SSVC assessment
Exploitation: none · Automatable: no · Technical impact: total
- Record last updated
Affected versions
- Unknown PDF Invoices & Packing Slips for WooCommerce
From 5.16.2 · fixed in 5.16.5
References 1
Questions about CVE-2026-111578
What does this mean?
Customer-supplied order fields, such as billing and shipping addresses and the customer order note, are output without proper escaping in generated invoice and packing-slip documents. A stored script placed through a guest order can run in a shop administrator's browser when that administrator views the document.Source: wpscan.com
Am I affected, and how do I check?
Plugin versions 5.16.2 through 5.16.4 are affected. The issue involves guest orders that contain these fields and an administrator viewing the generated document. The installed version can be checked on the WordPress Plugins screen.Source: wpscan.com
What should I do about it?
Update the plugin to version 5.16.5, the fixed release. The checked facts list no separate workaround.Source: wpscan.com
Is it being exploited?
It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.Source: cve.now feed data