Unauthenticated attackers can inject malicious scripts into customer order fields in the PDF Invoices & Packing Slips for WooCommerce plugin.
Affected component: PDF Invoices & Packing Slips for WooCommerce (plugin)
Fixed in: 5.16.5
PowerSEC coverage: PowerSEC detects the affected versions on every plan, and has since November 1, 2026. No PowerSEC firewall rule blocks this attack. Update to 5.16.5 or later to remove the vulnerability.
Full advisory, including detection steps and remediation: https://powersec.io/vulnerability/cve-2026-107750