The vulnerability is an insufficient sanitization and escaping flaw in the PDF Invoices & Packing Slips for WooCommerce WordPress plugin. When a guest checkout is completed, the billing first name, last name, company, and customer note fields are stored directly in the generated PDF without proper filtering. Attackers can insert entity‑encoded payloads such as <img onerror=…> that bypass the wp_kses allow‑list because no literal angle brackets are present. The encoded payload is later decoded into a real script tag and executed in any page that loads the PDF, giving an unauthenticated attacker the ability to run arbitrary code in the victim’s browser. This can lead to credential theft, session hijacking, defacement or further lateral movement within the site.

The affected product is the WordPress plugin PDF Invoices & Packing Slips for WooCommerce (code name wpovernight). All released versions through 5.16.4 are vulnerable. Users running a WordPress site that has this plugin installed and allows guest checkout for order creation are impacted.

The CVSS score of 7.2 classifies this vulnerability as a high‑severity flaw. The EPSS score is not published, and it is not listed in CISA KEV, so no publicly known exploits have been reported yet. The attack requires an unauthenticated user to access the guest checkout flow and submit a payload through one of the four form fields. Once stored, the malicious script will execute whenever a user opens the affected PDF invoice or packing slip, making the vector essentially a “client‑side” delivery mechanism that does not require any additional capabilities beyond standard web form submission.