CVE-2026-111578

Rejected reason: This CVE ID was reserved for a reported issue in the PDF Invoices & Packing Slips for WooCommerce WordPress plugin and was never published. On validation the reported behaviour was determined not to be a vulnerability: the Shop Manager role that could invoke the bulk invoice deletion and renumbering tool already holds the equivalent capability through the plugin's normal per-order invoice controls and through WooCommerce order management, so it crosses no privilege boundary. No CVE record should reference this ID.

The PDF Invoices & Packing Slips for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Billing First Name / Last Name / Company Fields in all versions up to, and including, 5.16.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload survives initial storage because WooCommerce's sanitize_text_field() and wc_clean() do not strip entity-encoded strings containing no literal '<' character, allowing unauthenticated guest-checkout orders to plant the malicious content.

The PDF Invoices & Packing Slips for WooCommerce plugin is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.16.5 via the 'invoice_number' parameter (via document filename). Unauthenticated attackers can extract another customer's complete invoice PDF, including billing identity, shipping address, private order notes, line items, prices, dates, order ID, and invoice number, delivered directly to the attacker's email as an order confirmation attachment.

The PDF Invoices & Packing Slips for WooCommerce plugin is vulnerable to Stored Cross-Site Scripting via the 'billing_address.first_name / last_name / company, customer_note' parameters in versions up to 5.16.4 due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts that execute when a user visits an injected page. This is an incomplete fix for CVE-2026-92244: the wp_kses() allow-list introduced in 5.16.2 correctly blocks raw-tag payloads but is bypassed by entity-encoded payloads (e.g., &lt;img onerror=…&gt;) that contain no literal angle-bracket characters and are therefore passed through unmodified before the trailing decode rematerializes them.

The PDF Invoices & Packing Slips for WooCommerce plugin for WordPress up to version 5.14.0 is vulnerable to Insecure Direct Object Reference (IDOR) in the generate_document_shortcode. Missing validation on a user-controlled key allows authenticated attackers with contributor-level access or higher to generate publicly accessible download links for arbitrary third-party orders, exposing sensitive customer data.