PDF Invoices & Packing Slips for WooCommerce <= 5.16.1 - Unauthenticated Stored Cross-Site Scripting via Billing First Name / Last Name / Company Fields

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-92244 · Microsoft / collected KEV context

cve-program · CVE-2026-92244

• https://www.wordfence.com/threat-intel/vulnerabilities/id/2ec3bd67-6e4b-46b6-8027-feeea149f3a4?source=cve
• https://plugins.trac.wordpress.org/browser/woocommerce-pdf-invoices-packing-slips/tags/5.16.1/assets/js/admin-script.js#L766
• https://plugins.trac.wordpress.org/browser/woocommerce-pdf-invoices-packing-slips/tags/5.16.1/includes/Settings.php#L470
• https://plugins.trac.wordpress.org/browser/woocommerce-pdf-invoices-packing-slips/tags/5.16.1/wpo-ips-functions.php#L658
• https://plugins.trac.wordpress.org/browser/woocommerce-pdf-invoices-packing-slips/tags/5.16.1/includes/Settings.php#L409
• https://plugins.trac.wordpress.org/changeset?reponame=&new=3707106%40woocommerce-pdf-invoices-packing-slips%2Ftags%2F5.16.2&old=3658456%40woocommerce-pdf-invoices-packing-slips%2Ftags%2F5.16.1

No related operational record is retained in the current change model.