Stored Cross-Site Scripting in WooCommerce PDF Invoices & Packing Slips Plugin

CVE-2026-107750

What is CVE-2026-107750?

The WooCommerce PDF Invoices & Packing Slips plugin for WordPress has a vulnerability that allows for stored cross-site scripting. This occurs via the 'billing_address.first_name / last_name / company, customer_note' parameters due to inadequate input sanitization and output escaping. Unauthenticated attackers can exploit this issue to inject arbitrary web scripts into pages, leading to potential execution whenever a user accesses the compromised page. Existing mitigations are insufficient, as they fail to block certain entity-encoded payloads, which can bypass security measures. Users are advised to upgrade to secure versions to protect against this vulnerability.

References