The plugin fails to escape several customer‑supplied order fields, including billing and shipping addresses and the customer order note, when generating invoice and packing‑slip PDFs. This allows an unauthenticated guest to inject a malicious script that executes inside the browser when a shop administrator opens the document, giving the attacker the ability to steal credentials, deface the site, or perform other malicious actions on the administrator’s session. The vulnerability is a classic Stored Cross‑Site Scripting flaw, affecting the confidentiality and integrity of the site’s administrative control plane.

The vulnerability affects the WordPress plugin PDF Invoices & Packing Slips for WooCommerce, versions 5.16.2 through 5.16.4 (inclusive). Any WordPress site using one of these releases is at risk.

With a CVSS score of 7.5 the flaw is considered high severity, and the exploit does not require any user authentication. Guest users can place orders with malicious input, immediately persisting arbitrary code in PDFs. Although the EPSS score is not listed and the vulnerability is not yet in CISA’s KEV catalog, an attacker does not need advanced tooling to abuse it—simply submitting a crafted order to a public checkout page suffices. Administration accounts that open the PDFs trigger the payload, creating a high‑risk attack surface.