CVE-2026-92244 is a stored cross-site scripting vulnerability in the PDF Invoices & Packing Slips for WooCommerce plugin for WordPress. It occurs due to improper neutralization of input during web page generation, specifically in the Billing First Name, Last Name, and Company fields. The vulnerability exists in all versions up to and including 5.16.1. The root cause is insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject arbitrary web scripts. WooCommerce's sanitize_text_field() and wc_clean() functions fail to strip entity-encoded strings without literal '<' characters, enabling the malicious payload to survive initial storage and execute when the injected page is accessed.

An unauthenticated attacker can inject arbitrary scripts into invoice or packing slip pages via guest checkout fields. These scripts execute in the context of users viewing the affected pages, potentially leading to session hijacking, data theft, or other client-side impacts. The CVSS 3.1 base score is 7.2 (high severity), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and partial confidentiality and integrity impact with no availability impact.

No official patch or fix is currently indicated in the provided data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider restricting guest checkout or sanitizing input fields via custom code as a temporary mitigation. Monitor vendor channels for updates and apply patches promptly once released.