CVE-2026-92244: Unauthenticated Stored XSS in WooCommerce PDF Invoices Plugin

CVE-2026-92244 is a high-severity (CVSS 7.2) stored XSS in the PDF Invoices & Packing Slips for WooCommerce plugin (<= 5.16.1) that lets unauthenticated attackers submit entity-encoded payloads in billing name/company fields via guest checkout; these payloads are decoded and executed when store admins view orders or generate invoices, potentially enabling admin session theft or full store compromise. The vulnerability is fixed in 5.16.2; the report recommends immediate patching, reviewing recent orders for suspicious encoded content, rotating admin sessions if exposure is suspected, and interim WAF or access-restriction mitigations.