CVE-2026-92244

Executive Summary

CVE-2026-92244 is a stored cross-site scripting (XSS) vulnerability in the PDF Invoices & Packing Slips for WooCommerce WordPress plugin affecting all versions up to and including 5.16.1. Unauthenticated attackers can plant malicious scripts through guest-checkout Billing First Name, Last Name, and Company fields, which are processed by WooCommerce's sanitize_text_field() and wc_clean() in a manner that fails to neutralize entity-encoded payloads lacking a literal < character. Because the plugin renders these fields into invoice and packing-slip views for administrative users, the injected script executes in an elevated-privilege context, enabling session theft and site compromise. The vulnerability is currently unpatched, with no vendor fix or workaround evidence available.

Technical Analysis

CVE-2026-92244 is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation, i.e., Cross-Site Scripting), specifically the stored (persistent) variant. The affected component is the "PDF Invoices & Packing Slips for WooCommerce" plugin for WordPress, a widely deployed extension that generates PDF invoices and packing slips from order data.

The vulnerability root cause, per the NVD description, is a combination of insufficient input sanitization and insufficient output escaping. The attack surface is the WooCommerce checkout flow, specifically the Billing First Name, Billing Last Name, and Billing Company fields. These fields are populated by the customer — including unauthenticated guest-checkout users — during order creation.

The critical and unusual characteristic of this issue is the stated bypass of WooCommerce's standard sanitization primitives, sanitize_text_field() and wc_clean(). According to the description, these functions do not strip entity-encoded strings that contain no literal < character. This means an attacker can supply an HTML-entity-encoded payload (for example, an entity form of a script element) that passes through sanitization because the literal < character is absent. If the plugin later decodes or renders that entity-encoded value without output escaping, the browser reconstructs the executable markup, and the script executes in the victim's session context.

The precondition for exploitation is that the plugin must persist or render these billing fields in a context where they are delivered to a browser without proper contextual output encoding. The NVD description states that the injected payload "will execute whenever a user accesses an injected page," indicating server-side persistence and subsequent rendering. Administrative users viewing orders, invoices, or packing slips are the most probable victims given the plugin's function.

The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N, yielding a base score of 7.2 (HIGH). The PR:N reflects that no authentication is required to submit the malicious order data via guest checkout. The UI:N indicates no victim interaction beyond normal page access is needed. The S:C (Scope Changed) is significant: the vulnerable component (checkout / plugin rendering context) impacts resources beyond its security scope — the administrative user's browser session. Confidentiality and Integrity impacts are both rated Low (C:L/I:L), while Availability is None (A:N).

Because confidentiality and integrity are rated Low, the direct code-execution or data-loss potential in the vulnerable component itself is limited, but the scope change elevates the effective risk. In practice, stored XSS in a WordPress administrative context commonly escalates to full site takeover through session hijacking, creation of rogue administrative accounts, or injection of persistent backdoors — though such post-exploitation specifics are not detailed in the provided data and must be treated as a plausible consequence of the vulnerability class rather than a documented chain.

No public proof-of-concept, Nuclei template, or exploit code is known to exist for CVE-2026-92244 at the time of writing. No EPSS score has been assigned by FIRST.org. The vulnerability is not listed in CISA KEV. No affected-version entries, vendor fix, or OSV package mappings were returned by tracked sources, and patch confidence is 0/4, indicating no patch evidence from any source.

Exploitation Scenarios

No public PoC is available for CVE-2026-92244; the attack chain below is inferred from the stored XSS vulnerability class and the specifics stated in the NVD description. All referenced field names (Billing First Name, Billing Last Name, Billing Company) and functions (sanitize_text_field(), wc_clean()) appear verbatim in the description; no additional implementation details are fabricated.

1. Reconnaissance / Target Identification. The attacker identifies WordPress sites running the "PDF Invoices & Packing Slips for WooCommerce" plugin at a version at or below 5.16.1. Public footprinting is straightforward: plugin assets are typically served from predictable plugin directory paths, and the presence of an active WooCommerce storefront is observable from any product or cart page. Attackers can fingerprint plugin presence and version through passive HTTP responses and publicly enumerable asset paths. No authentication is required at this stage.

2. Triggering the Flaw. The attacker proceeds through the WooCommerce guest checkout flow — which is reachable by unauthenticated users by design — and places an order. During checkout, the attacker supplies a crafted payload into one or more of the Billing First Name, Last Name, or Company fields. The payload is constructed as an entity-encoded string that deliberately contains no literal < character, so that it survives sanitize_text_field() and wc_clean(). Because guest checkout does not require prior account creation or authentication, the attacker can submit this malicious order without any credentials.

3. Payload Storage and Execution. The malicious billing data is stored as part of the order record. When the plugin subsequently renders this order data — for example, within invoice or packing-slip output viewed by an administrator or shop manager — the entity-encoded payload is delivered to the browser. If the rendering context does not apply proper output escaping, the browser decodes the entities and reconstructs executable markup, causing the arbitrary web script to execute in the victim user's session. The NVD description confirms the payload "will execute whenever a user accesses an injected page."

4. Post-Exploitation Impact. Successful execution of arbitrary script in the context of a privileged administrative session enables actions available to that session. In WordPress environments, this commonly translates to session-token theft, authenticated actions performed on the administrator's behalf, and — given administrative privileges — potential site-wide compromise. However, because the CVSS confidentiality and integrity impacts are rated Low and no public evidence of specific post-exploitation tooling exists for this CVE, the exact upper bound of the chain should not be overstated. The scope change (S:C) indicates the vulnerable component affects resources beyond its own security context, consistent with cross-privilege impact on the administrative browser session.

No exploit code, no weaponized payload, and no observed in-the-wild campaigns are documented for this CVE in the provided intelligence.

Impact Assessment

CVE-2026-92244 carries a CVSS 3.1 base score of 7.2 (HIGH), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N. The subscores describe a network-reachable, low-complexity vulnerability requiring no privileges and no user interaction to plant the payload, with a scope change and Low confidentiality/integrity impact.

Affected systems. Any WordPress installation running the "PDF Invoices & Packing Slips for WooCommerce" plugin at version 5.16.1 or earlier. Because the plugin supports guest checkout, unauthenticated external parties can reach the vulnerable input path. WooCommerce is deployed on a very large number of e-commerce WordPress sites, so the potential population of exposed installations is broad, though precise counts are not provided in the source data.

Blast radius. The primary victim set is administrative and shop-management users who view order records, invoices, or packing slips containing the injected data. The scope change (S:C) means impact extends beyond the vulnerable plugin context to the victim's browser session and, potentially, the entire WordPress administrative backend. Because the injection is stored persistently, it can affect multiple viewers over time rather than being limited to a single interaction.

Business impact. Stored XSS in an administrative e-commerce context is a serious concern. Successful exploitation can lead to theft of session credentials, unauthorized administrative actions, manipulation of order or invoice data, and — in worst-case interpretations of the access obtained — full site compromise. The presence of malicious scripts in invoices or packing slips could also expose downstream recipients (e.g., customers receiving PDFs) depending on rendering behavior, although the NVD description focuses on browser-based execution upon page access rather than PDF embedding. Confidentiality and integrity impacts are rated Low, indicating limited direct data exposure per the CVSS calculus, but the persistent nature and privileged victim context amplify operational risk.

At this time there is no EPSS score, no CISA KEV listing, no public PoC, and no patch. The absence of a patch (0/4 confidence) means every installation at or below 5.16.1 remains exposed until a fix is released.

Detection Guidance

Detection for this stored XSS centers on (a) observing crafted entity-encoded payloads submitted to WooCommerce checkout endpoints, (b) detecting script content in rendered administrative pages, and (c) hunting for anomalous order-metadata containing the HTML entity notation < combined with script-like keywords (e.g., script, onerror, onload, javascript) in billing fields. No public PoC exists, so the following rules are based on the vulnerability class and the entity-encoded payload characteristic described in the NVD data.

Sigma Rule

title: Potential WooCommerce Billing Field Stored XSS Payload (CVE-2026-92244)
id: 8f2c1b4a-9d3e-4f7a-b2c1-6e5d4a3b2c10
status: experimental
description: Detects entity-encoded script payloads submitted to WooCommerce checkout billing fields targeting CVE-2026-92244.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-92244
author: Valters IT Threat Intelligence
date: 2026/01/01
logsource:
  category: webserver
  product: apache
detection:
  selection_method:
    cs-method:
      - 'POST'
  selection_uri:
    cs-uri-stem|contains:
      - '/checkout'
      - '/?wc-ajax=checkout'
  selection_payload:
    cs-uri-query|contains:
      - '<script'
      - '%26lt%3Bscript'
      - 'javascript:'
      - 'onerror='
      - 'onload='
      - '<'
  selection_field:
    cs-uri-query|contains:
      - 'billing_first_name'
      - 'billing_last_name'
      - 'billing_company'
  condition: selection_method and selection_uri and selection_field and selection_payload
fields:
  - c-ip
  - cs-uri-query
  - cs-user-agent
falsepositives:
  - Benign orders containing the literal text "script" or entity sequences
level: high

YARA Rule

rule CVE_2026_92244_WooCommerce_Stored_XSS
{
    meta:
        description = "Detects entity-encoded script payloads associated with WooCommerce billing-field stored XSS (CVE-2026-92244)"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-92244"
        author = "Valters IT Threat Intelligence"
        date = "2026-01-01"
        severity = "high"
    strings:
        $en1 = "<script" nocase
        $en2 = "<img" nocase
        $en3 = "<svg" nocase
        $en4 = "<script" nocase
        $js1 = "javascript:" nocase
        $js2 = "onerror=" nocase
        $js3 = "onload=" nocase
        $js4 = "alert(" nocase
        $bf1 = "billing_first_name" nocase
        $bf2 = "billing_last_name" nocase
        $bf3 = "billing_company" nocase
    condition:
        (uint16(0) != 0x5A4D) and
        (any of ($bf1, $bf2, $bf3)) and
        ((any of ($en*)) or (2 of ($js*)))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-92244 WooCommerce Billing Field Stored XSS Attempt"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"checkout"; nocase; http.request_body; content:"billing_first_name"; nocase; http.request_body; content:"script"; nocase; distance:0; http.request_body; content:"<"; nocase; http.request_body; content:"billing_company"; nocase; classtype:web-application-attack; reference:cve,2026-92244; sid:202692244; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=5m
  [network where network.protocol == "http" and
    http.request.method == "POST" and
    http.request.body.content : ("billing_first_name" or "billing_last_name" or "billing_company")]
  [network where network.protocol == "http" and
    http.request.body.content : ("<script" or "javascript:" or "onerror=" or "onload=")]

Splunk SPL Query

index=web sourcetype=access_combined OR sourcetype=nginx:plus:access
| eval payload = cs_uri_query . " " . cs_uri_stem
| where match(payload, "(?i)(billing_first_name|billing_last_name|billing_company)")
| where match(payload, "(?i)(%26lt%3Bscript|<script|javascript:|onerror=|onload=|%3Cscript)")
| stats count values(c_ip) as src_ips values(cs_user_agent) as user_agents by cs_uri_stem, cs_uri_query
| where count > 0
| sort - count

Wazuh OSSEC Rule

<group name="web,woocommerce,xss,">
  <rule id="2026922" level="12">
    <if_sid>31100</if_sid>
    <id>^POST$</id>
    <url>checkout</url>
    <match>billing_first_name|billing_last_name|billing_company</match>
    <regex>(?i)(&lt;script|%26lt%3Bscript|javascript:|onerror=|onload=)</regex>
    <description>CVE-2026-92244: Possible stored XSS payload submitted via WooCommerce billing fields</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_92244,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix or workaround is documented in the provided intelligence. The following measures are protective and containment-oriented; they do not constitute an official patch.

1) Immediate mitigations.

• Restrict or disable guest checkout if operationally feasible, forcing authenticated order creation. This removes the unauthenticated attack vector (PR:N) described by the CVSS vector, though it does not fix the underlying sanitization/escaping flaw.
• Deploy a Web Application Firewall (WAF) with virtual patching rules that inspect WooCommerce checkout POST bodies for entity-encoded script payloads (e.g., sequences combining </%26lt%3B with script, onerror, onload, javascript:), targeting the Billing First Name, Last Name, and Company parameters.
• Apply strict server-side output escaping at any custom template that renders order or billing data — particularly anywhere the plugin's invoice/packing-slip views are customized.
• Limit exposure by ensuring administrative and shop-manager accounts use unique, short-lived sessions and — where possible — IP allow-listing for wp-admin access.
• Deploy a Content Security Policy that disallows inline script execution as a defense-in-depth control to blunt any successful stored XSS.

2) Patch / upgrade steps.

• No patched version is currently identified. Monitor the plugin vendor's official release channel and the NVD entry for CVE-2026-92244 for a fixed version announcement.
• Until an official fix ships, do not rely on upgrade as a remediation path. Treat all installations at or below 5.16.1 as vulnerable.
• If the vendor releases a fix, validate it in a staging environment and roll it out promptly; re-test that the entity-encoding bypass no longer succeeds before considering the issue resolved.

3) Long-term hardening.

• Enforce contextual output encoding across all plugin and theme templates that render user-supplied or order-supplied data, rather than relying on input filtering alone.
• Audit any use of WooCommerce sanitization primitives (sanitize_text_field(), wc_clean()) in custom code to ensure entity-encoded values are handled safely at render time.
• Maintain an inventory of WordPress plugins with version tracking and a cadence for security review; unmaintained or slow-to-patch plugins should be prioritized for replacement.
• Continuously monitor CVE feeds, the NVD entry, and vendor channels for patch availability and any change in EPSS or CISA KEV status.
• Implement logging and alerting for anomalous checkout submissions and administrative page access to detect attempted or successful exploitation.

References

• NVD — CVE-2026-92244: https://nvd.nist.gov/vuln/detail/CVE-2026-92244
• CWE-79 — Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'): https://cwe.mitre.org/data/definitions/79.html
• CVSS v3.1 Specification: https://www.first.org/cvss/v3.1/specification-document
• FIRST.org EPSS (no score currently assigned for this CVE): https://www.first.org/epss/
• CISA Known Exploited Vulnerabilities Catalog (CVE-2026-92244 not listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No threat actor campaigns, exploit-in-the-wild evidence, public PoC, Nuclei template, or OSV package mappings were identified for CVE-2026-92244 in the available intelligence.