CVE-2026-107750

Summary

A Stored Cross-Site Scripting (XSS) vulnerability affects the PDF Invoices & Packing Slips for WooCommerce plugin. Unauthenticated attackers can inject malicious scripts into customer order fields. The vulnerability is patched in version 5.16.5. A Proof of Concept (PoC) for this vulnerability is scheduled.

Affected and patched versions

• PDF Invoices & Packing Slips for WooCommerce (plugin woocommerce-pdf-invoices-packing-slips): affected 5.16.4 and earlier; fixed in 5.16.5

Is my site vulnerable?

To determine if your WordPress site is vulnerable, check the version of the PDF Invoices & Packing Slips for WooCommerce plugin installed.

1. Log in to your WordPress administration dashboard.

2. Navigate to the "Plugins" menu item, then select "Installed Plugins".

3. Locate "PDF Invoices & Packing Slips for WooCommerce" in the list of installed plugins.

4. Examine the version number displayed next to the plugin name.

Your site is vulnerable if the installed version of PDF Invoices & Packing Slips for WooCommerce is 5.16.4 or earlier. Sites running version 5.16.5 or later are not affected by this specific vulnerability.

What an attacker actually does

This vulnerability, identified as CVE-2026-107750, stems from insufficient input sanitization and output escaping within the PDF Invoices & Packing Slips for WooCommerce plugin. The plugin fails to properly process several customer-supplied order fields, including billing address values (first name, last name, company) and the customer order note, before these details are incorporated into generated invoice and packing-slip documents. This oversight creates an opportunity for unauthenticated attackers to inject arbitrary web scripts into these fields when placing a guest order.

An attacker initiates the compromise by submitting an order that contains malicious script code within fields such as billing_address.first_name, billing_address.last_name, billing_address.company, or customer_note. Because the plugin does not adequately sanitize or escape this input, the malicious script is stored directly in the site's database as part of the order record. The vulnerability has a CVSS score of 7.5 (high), indicating a network attack vector, high attack complexity, no privileges required for the attacker, and user interaction required for the script to execute. The weakness is categorized as CWE-79, Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting').

The stored script remains dormant until a shop administrator or another authorized user accesses an invoice or packing slip document generated from the compromised order. When the administrator views the document, the malicious script, embedded within the order details, executes within their browser context. This Stored Cross-Site Scripting (XSS) can lead to various negative outcomes, including session hijacking, data theft, or further compromise of the administrator's account or the WordPress site itself. This vulnerability represents an incomplete fix for a previous issue, CVE-2026-92244. While a wp_kses() allow-list was introduced in version 5.16.2 to block raw HTML tags, attackers can bypass this protection by using entity-encoded payloads (e.g., <img onerror=...>). These encoded payloads contain no literal angle-bracket characters, allowing them to pass through the sanitization process unmodified before a trailing decode step rematerializes them into executable HTML.

How to detect a compromise

Detecting a compromise related to CVE-2026-107750 involves inspecting your WordPress database for malicious scripts or suspicious encoded characters within customer order fields. The injected scripts are stored as part of order metadata.

You can examine the wp_postmeta table in your WordPress database. Specifically, look for entries associated with post_type = 'shop_order' and meta_key values such as _billing_first_name, _billing_last_name, _billing_company, or _customer_note.

Search for common XSS payload patterns or encoded HTML entities within the meta_value column. These patterns might include:

• <script or <script

• <img or <img

• onerror=

• javascript:

• Other HTML entities like < (for <) or > (for >)

Using SQL (via phpMyAdmin or similar tool): You can run SQL queries to search for suspicious content. Replace wp_ with your actual database prefix if it is different.

SELECT post_id, meta_key, meta_value
FROM wp_postmeta
WHERE meta_key IN ('_billing_first_name', '_billing_last_name', '_billing_company', '_customer_note')
AND (
    meta_value LIKE '%<script%' OR
    meta_value LIKE '%<script%' OR
    meta_value LIKE '%onerror=%' OR
    meta_value LIKE '%javascript:%' OR
    meta_value LIKE '%&#x3C;%'
);

This query will return order IDs and the specific meta fields where potentially malicious content is found. Review the meta_value for any unexpected or encoded script fragments.

Using WP-CLI: For sites with WP-CLI access, you can iterate through recent orders and inspect their metadata. This approach can be more resource-intensive for large numbers of orders.

To list recent orders:

wp post list --post_type=shop_order --field=ID --posts_per_page=50

Then, for each ID, inspect its metadata:

wp post meta get <ORDER_ID> _billing_first_name
wp post meta get <ORDER_ID> _billing_last_name
wp post meta get <ORDER_ID> _billing_company
wp post meta get <ORDER_ID> _customer_note

Replace <ORDER_ID> with the actual order ID. Look for the same suspicious patterns as described for the SQL query.

Regularly reviewing your site's access logs for unusual activity, especially around the time of order submissions or administrator access to invoice generation, can also provide supplementary indicators of compromise.

How to fix

To address the CVE-2026-107750 vulnerability in PDF Invoices & Packing Slips for WooCommerce, follow these steps:

1. Update the Plugin: The primary remediation is to update the PDF Invoices & Packing Slips for WooCommerce plugin to version 5.16.5 or later. This version contains the necessary fixes for the input sanitization and output escaping issues.

   • Log in to your WordPress administration dashboard.

   • Navigate to "Plugins" > "Installed Plugins".

   • Locate "PDF Invoices & Packing Slips for WooCommerce".

   • If an update is available, click the "Update Now" link beneath the plugin name. If no update link is visible, your plugin may already be at the latest version or you may need to manually update.

   • Confirm the update completes successfully.

2. Review and Clean Existing Data: After updating the plugin, it is advisable to review existing order data for any previously injected malicious scripts. Use the detection methods described in the "How to detect a compromise" section to identify any affected meta_value entries in the wp_postmeta table.

   • If you find malicious scripts, carefully remove or sanitize the affected meta_value content. Exercise caution when directly editing database entries. Back up your database before making any manual changes.

   • For example, if an entry for _customer_note contains <script>alert('XSS')</script>, you should remove the script portion, leaving only legitimate customer notes.

3. Clear Caches: If your site uses caching plugins or services, clear all caches after updating the plugin and reviewing data to ensure the updated code and any cleaned data are served correctly.

Timeline

Sources

• https://nvd.nist.gov/vuln/detail/CVE-2026-107750

• https://www.wordfence.com/threat-intel/vulnerabilities/id/9456cd66-d608-49b8-ad4c-fdc89db4cd29

• https://wordpress.org/plugins/woocommerce-pdf-invoices-packing-slips/

• https://wpscan.com/vulnerability/ac5d0074-295d-46ee-b2ad-8bfd3ef9917b/

• https://github.com/advisories/GHSA-xq56-qcfx-62xr