VulnCrest
Search
Create account
Report an incident
Radar sectionsPlugins & themes
Check my site

WordPress plugin

PDF Invoices & Packing Slips for WooCommerce security & vulnerabilities

woocommerce-pdf-invoices-packing-slips— active installsLast vulnerability Oct 30, 2026

No known unpatched vulnerabilities in the latest version

All 17 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.

Watch plugin
17Known vulnerabilities
  • Critical0
  • High5
  • Medium12
  • Low0
Vulnerabilities per year
2017: 1 vulnerability1172021: 1 vulnerability1212022: 3 vulnerabilities3222023: 1 vulnerability1232024: 4 vulnerabilities4242025: 1 vulnerability1252026: 6 vulnerabilities626

All PDF Invoices & Packing Slips for WooCommerce vulnerabilities

PDF Invoices & Packing Slips for WooCommerce vulnerabilities
SeverityVulnerabilityCVEPublished
High7.2Unauthenticated Stored Cross-Site Scripting via Billing First Name / Last Name / Company / Customer Note fields at guest checkout
≤5.16.4Update to 5.16.5
CVE-2026-107750
Medium5.3Unauthenticated Sensitive Information Exposure via Yearly-Reset Invoice Attachment Cache
≤5.16.5Update to 5.16.6
CVE-2026-109217
High7.2Unauthenticated Stored Cross-Site Scripting via Billing First Name / Last Name / Company Fields
≤5.16.1Update to 5.16.2
CVE-2026-92244
Medium4.3Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Disclosure via 'order_id' Shortcode Attribute
≤5.14.0Update to 5.15.0
CVE-2026-13116
Medium6.6Authenticated (Shop manager+) PHP Object Injection
<5.9.0Update to 5.9.0
CVE-2026-39472
Medium4.3Missing Authorization to Authenticated (Subscriber+) Peppol Identifier Modification
≤5.6.0Update to 5.7.0
CVE-2026-1906
Medium4.3Missing Authorization
≤4.9.1Update to 5.0.0
CVE-2025-67589
Medium5.3Missing Authorization
≤3.8.6Update to 3.8.7
CVE-2024-50421
High7.2Unauthenticated Server-Side Request Forgery
≤3.8.0Update to 3.8.1
CVE-2024-3047
High7.2Unauthenticated Stored Cross-Site Scripting
≤3.8.0Update to 3.8.1
CVE-2024-3045
High7.2Authenticated (Shop Manager+) SQL Injection
≤3.7.6Update to 3.7.7
CVE-2024-22147
Medium4.3Cross Site Request Forgery
≤3.2.5Update to 3.2.6
CVE-2022-47148
Medium6.13.0.0 - Reflected Cross-Site Scripting
2.14.0 – 3.0.0Update to 3.0.1
CVE-2022-2537
Medium5.4Reflected Cross-Site Scripting
≤2.15.0Update to 2.16.0
CVE-2022-2092
Medium6.1Cross-Site Scripting
2.14.5 – 2.14.5Update to 2.15
—
Medium4.8Reflected Cross-Site Scripting via tab and section parameter
<2.10.5Update to 2.10.5
CVE-2021-24991
Medium6.1Cross-Site Scripting
<2.0.13Update to 2.0.13
CVE-2017-18506

PDF Invoices & Packing Slips for WooCommerce: common questions

Does PDF Invoices & Packing Slips for WooCommerce have known vulnerabilities?

Yes. VulnCrest Radar lists 17 known vulnerabilities in PDF Invoices & Packing Slips for WooCommerce: 5 high, 12 medium. None are known to affect version null.

How do I check which version of PDF Invoices & Packing Slips for WooCommerce I run?

In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.

What is the most recent PDF Invoices & Packing Slips for WooCommerce vulnerability?

CVE-2026-107750, published Oct 30, 2026: PDF Invoices & Packing Slips for WooCommerce <= 5.16.4 - Unauthenticated Stored Cross-Site Scripting via Billing First Name / Last Name / Company / Customer Note fields at guest checkout. Severity: High (CVSS 7.2).

Is any PDF Invoices & Packing Slips for WooCommerce vulnerability listed in CISA KEV?

No. None of the known PDF Invoices & Packing Slips for WooCommerce vulnerabilities is currently listed in the CISA KEV catalog.

Search VulnCrest Radar

Jump to

Are you sure?