CVE-2022-2092: WooCommerce PDF Invoices & Packing Slips < 2.16.0 - Reflected Cross-Site Scripting

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.8% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2022-07-11 · updated 2026-06-17
Weakness: CWE-79

Description

The WooCommerce PDF Invoices & Packing Slips WordPress plugin before 2.16.0 doesn't escape a parameter on its setting page, making it possible for attackers to conduct reflected cross-site scripting attacks.

Affected products

wpovernight PDF Invoices & Packing Slips for WooCommerce: before 2.16.0 — fixed in 2.16.0

How to fix

Upgrade to a fixed version: wpovernight PDF Invoices & Packing Slips for WooCommerce 2.16.0. Check the vendor advisory for mitigations.

References

https://wpscan.com/vulnerability/87546554-276a-45fe-b2aa-b18bfc55db2d
https://wpscan.com/vulnerability/87546554-276a-45fe-b2aa-b18bfc55db2d

Get alerted when CVE-2022-2092 or the next vulnerability affects your stack