PDF Invoices & Packing Slips for WooCommerce vulnerabilities

Rejected reason: This CVE ID was reserved for a reported issue in the PDF Invoices & Packing Slips for WooCommerce WordPress plugin and was never published. On validation the reported behaviour was determined not to be a vulnerability: the Shop Manager role that could invoke the bulk invoice deletion and renumbering tool already holds the equivalent capability through the plugin's normal per-order invoice controls and through WooCommerce order management, so it crosses no privilege boundary. No CVE record should reference this ID.

The PDF Invoices & Packing Slips for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Billing First Name / Last Name / Company Fields in all versions up to, and including, 5.16.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload survives initial storage because WooCommerce's sanitize_text_field() and wc_clean() do not strip entity-encoded strings containing no literal '<' character, allowing unauthenticated guest-checkout orders to plant the malicious content.

The PDF Invoices & Packing Slips for WooCommerce plugin for WordPress up to version 5.14.0 is vulnerable to Insecure Direct Object Reference (IDOR) in the generate_document_shortcode. Missing validation on a user-controlled key allows authenticated attackers with contributor-level access or higher to generate publicly accessible download links for arbitrary third-party orders, exposing sensitive customer data.