Threats tagged 'ghsa-wr38-p24w-wp68'

The PDF Invoices & Packing Slips for WooCommerce plugin for WordPress versions up to and including 5.16.4 contains a stored cross-site scripting (XSS) vulnerability. This flaw arises from insufficient input sanitization and output escaping of certain parameters such as billing_address.first_name, last_name, company, and customer_note. An incomplete fix introduced in version 5.16.2 attempted to block raw-tag payloads but was bypassed by entity-encoded payloads, allowing script injection that executes when a user accesses the affected page.