Threats tagged 'ghsa-xq56-qcfx-62xr'

A stored cross-site scripting (XSS) vulnerability exists in the PDF Invoices & Packing Slips for WooCommerce WordPress plugin versions from 5.16.2 up to but not including 5.16.5. The plugin does not properly escape certain customer-supplied order fields, such as billing and shipping addresses and customer order notes, in generated invoice and packing-slip documents. This allows unauthenticated users placing guest orders to inject malicious scripts that execute when a shop administrator views these documents.