# CVE-2026-111578: PDF Invoices & Packing Slips for WooCommerce stored XSS in order fields

Source: https://junglewise.ai/threats/cve-2026-111578-the-pdf-invoices-packing-slips-for-woocommerce-wordpress-plugin  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-30. Updated: 2026-10-30  
License: CC BY 4.0 with a link back

CVE-2026-111578 · Severity: high · CVSS 7.5 · Published 2026-10-30

The PDF Invoices & Packing Slips for WooCommerce plugin generates invoice and packing slip documents for online store orders. A guest customer placing an order can inject malicious script into billing address, shipping address, or order note fields that executes when a shop administrator views the generated document, allowing account takeover or data theft.

Vendors: [WooCommerce](https://junglewise.ai/threats/vendors/woocommerce).

## Quick answers

**Is CVE-2026-111578 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-111578 being exploited in the wild.

**How severe is CVE-2026-111578?** High severity, with a CVSS score of 7.5, published 30 October 2026.

**Which products and versions are affected?** WooCommerce PDF Invoices & Packing Slips 5.16.2 to 5.16.4.

**Is there a fix for CVE-2026-111578?** Yes: fixed in 5.16.5. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-111578 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-111578?** Check whether you run WooCommerce PDF Invoices & Packing Slips at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 5.16.5

## Technical details

The plugin fails to properly escape customer-supplied input in order fields (billing address, shipping address, customer notes) before rendering them in PDF invoice and packing-slip output. An unauthenticated attacker can inject XSS payloads during guest checkout that persist in generated documents; the payload executes with administrator privileges when the documents are viewed. This is a stored XSS affecting all users who view affected invoices and packing slips.

## Affected products

- WooCommerce PDF Invoices & Packing Slips 5.16.2 to 5.16.4

## Timeline

- 2026-10-29: disclosed

## References

- [https://wordpress.org/plugins](https://wordpress.org/plugins)
- [https://wpscan.com/vulnerability/ac5d0074-295d-46ee-b2ad-8bfd3ef9917b/](https://wpscan.com/vulnerability/ac5d0074-295d-46ee-b2ad-8bfd3ef9917b/)

## Related threats

- [PDF Invoices & Packing Slips for WooCommerce privilege boundary concern](https://junglewise.ai/threats/cve-2026-111593-rejected-reason-this-cve-id-was-reserved-for-a-reported-issue-in)