CVE-2026-52704

CriticalCVSS 10.0/10Last modified Jun 17, 2026

Description

Improper Control of Generation of Code ('Code Injection') vulnerability in Edgar Rojas WooCommerce PDF Invoice Builder allows Remote Code Inclusion.

This issue affects WooCommerce PDF Invoice Builder: from n/a through 2.0.8.

Metrics

CVSS 3.1 10.0/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-94

Affected software

No affected versions have been published.

Timeline

Published
Jun 15, 2026
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-527059.0Unauthenticated Arbitrary File Upload in SigmaForms Pro – AI Generated Forms <= 1.4.5 versions.CVE-2026-527069.8Unauthenticated PHP Object Injection in JetEngine <= 3.8.10 versions.CVE-2026-527078.1Unauthenticated Local File Inclusion in Kastell <= 2.0 versions.CVE-2026-52717.8pymanager included the current working directory in sys.path meaning modules could be shadowed by modules in the current working directory. CVE-2026-527117.5Unauthenticated Broken Access Control in WooCommerce POS <= 1.8.14 versions.CVE-2026-527127.6Subscriber SQL Injection in Attendance Manager <= 0.6.2 versions.CVE-2026-527145.9Unauthenticated Broken Access Control in SEO Plugin by Squirrly SEO <= 12.4.16 versions.CVE-2026-527159.3Unauthenticated SQL Injection in GEO my WordPress <= 4.5.5 versions.CVE-2026-527166.5Unauthenticated Arbitrary File Deletion in WorkScout-Core <= 1.7.11 versions.CVE-2026-527186.5A denial of service vulnerability was found in GStreamer's AV1 codec parser in gst-plugins-bad. The gst_av1_parser_parse_tile_list_obu() funCVE-2026-527197.1An out-of-bounds read vulnerability was found in the VA JPEG decoder in GStreamer's gst-plugins-bad. The JPEG parser reads a segment length CVE-2026-52728.8Heap buffer overflow in GPU in Google Chrome prior to 146.0.7680.178 allowed a remote attacker to execute arbitrary code via a crafted HTML
CVE-2026-52704: Critical severity, CVSS 10.0 | Vulnix