CVE-2026-107750

Name of the Vulnerable Software and Affected Versions PDF Invoices & Packing Slips for WooCommerce versions prior to 5.16.5

Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts through the billing address.first name, billing address.last name, billing address.company, and customer note parameters. These scripts execute when a user accesses the affected page. The issue persists because the wp kses() function, used for filtering HTML, is bypassed by entity-encoded payloads that do not contain literal angle-bracket characters, allowing them to be processed and later rematerialized as active scripts.

Recommendations Update PDF Invoices & Packing Slips for WooCommerce to version 5.16.5 or later. Restrict the use of the billing address.first name, billing address.last name, billing address.company, and customer note parameters until the update is applied.