Description

Subscriber Cross Site Scripting (XSS) in AfterShip Tracking <= 1.18.1 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-13T14:17:07.123Z",
  "pubdate": "2026-08-13T14:17:07.123Z",
  "executiveSummary": "A Cross-Site Scripting (XSS) vulnerability exists in the AfterShip Tracking plugin affecting versions 1.18.1 and prior. This security flaw enables authenticated users with subscriber-level privileges to inject malicious client-side scripts, typically JavaScript, into vulnerable application parameters or endpoints. When rendered by the victim's browser, the injected payload executes within the security context of the user's active session, potentially leading to unauthorized actions, session hijacking, or the exposure of sensitive data.\nThe risk implication is moderate to high depending on the privileges of the targeted user, as successful exploitation against administrative accounts could result in full site compromise. The attack requires authenticated access at the subscriber privilege level, meaning an attacker must first provision or compromise a low-privilege account within the WordPress environment. No specialized client interaction beyond viewing the affected component is strictly required for the execution of the stored script, posing an ongoing risk to application integrity.",
  "technicalDetails": "The root cause of the vulnerability stems from insufficient input sanitization and inadequate output encoding within the AfterShip Tracking <= 1.18.1 codebase. Specifically, parameters or input vectors processed by the application fail to properly neutralize HTML markup and JavaScript constructs before reflecting or storing them within the Document Object Model (DOM).\nThe vulnerable component resides within the plugin's handling of user-supplied data accessible to authenticated users holding subscriber-level privileges. Because the application trusts input from this tier without applying strict contextual output escaping, an attacker can supply malicious payloads containing script tags or event handlers.\nThe attack flow proceeds as follows: First, the authenticated attacker with subscriber privileges submits a crafted payload containing malicious JavaScript via vulnerable input vectors handled by the plugin. Second, the application accepts this input and stores it improperly without performing rigorous sanitization or encoding. Third, when a victim accesses the affected administrative or front-end page containing the stored payload, the server renders the raw input directly into the response.\nUpon receipt of the HTTP response, the victim's browser parses the malicious payload as executable code rather than inert text data. The script executes within the context of the victim's browser session, granting the attacker the ability to interact with the DOM, manipulate page content, exfiltrate session cookies, or perform unauthorized administrative actions if the victim possesses elevated privileges.\nPrerequisites for this attack include network exposure to the target web application, active authentication credentials yielding subscriber-level privileges, and the presence of the vulnerable AfterShip Tracking plugin versions 1.18.1 or earlier."
}