WordPress WooCommerce PDF Invoices & Packing Slips Stored XSS Vulnerability (CVE-2026-107750) Security Advisory

1. Vulnerability Overview & Root Cause

This vulnerability (CVE-2026-107750) is a Stored Cross-Site Scripting (XSS) flaw in the 'PDF Invoices & Packing Slips for WooCommerce' plugin for WordPress. It stems from an incomplete fix for a prior vulnerability, CVE-2026-92244. Although version 5.16.2 introduced wp_kses() sanitization to block raw HTML tags, the application failed to account for subsequent entity decoding during the rendering phase. Consequently, entity-encoded payloads bypass the initial sanitization filter and are later decoded back into executable scripts.

2. Exploitation Mechanics & Attack Scenario

An unauthenticated attacker initiates a checkout process and populates fields such as billing_address.first_name, billing_address.last_name, billing_address.company, or customer_note with malicious payloads. Instead of using literal angle brackets, the attacker uses HTML entity-encoded representations (e.g., <img onerror=...>). Because the input lacks literal < or > characters, the wp_kses() filter permits the payload. When an administrator views the generated PDF invoice or order details in the backend, the application decodes the entities, executing the malicious script within the administrator's browser session.

3. Infrastructure & Business Impact

Assessed with a CVSS score of 7.2 (High), this vulnerability poses a severe threat to e-commerce operations. Successful exploitation allows unauthenticated attackers to execute arbitrary JavaScript in the context of an authenticated administrator. This can lead to full administrative takeover, theft of sensitive customer Personally Identifiable Information (PII), modification of payment gateways, or complete server compromise via malicious plugin installations.