Description

Unauthenticated Cross Site Scripting (XSS) in Local Delivery Drivers for WooCommerce <= 3.0.0 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-08-13T14:17:08.237Z",
  "pubdate": "2026-08-13T14:17:08.237Z",
  "executiveSummary": "An unauthenticated Cross-Site Scripting (XSS) vulnerability has been identified in the Local Delivery Drivers for WooCommerce plugin, specifically affecting versions 3.0.0 and prior. This security flaw permits unauthenticated malicious actors to inject arbitrary client-side scripts, such as JavaScript or HTML, into trusted web pages rendered by the application and viewed by unsuspecting end users or administrators. The risk implications associated with this vulnerability include the potential compromise of user sessions, redirection to malicious infrastructure, theft of sensitive authentication cookies, and unauthorized execution of administrative actions within the context of the affected WordPress site.\nThe vulnerability requires no prior authentication or specific privileges, meaning any remote attacker with network access to the target web application can initiate an exploit vector. Exploitation typically relies on tricking a user or administrator into interacting with a specially crafted URL containing malicious payload parameters that fail to undergo proper sanitization or output encoding before being reflected back to the browser. As a result, the confidentiality, integrity, and availability of the web application and its users are significantly threatened, necessitating prompt remediation.",
  "technicalDetails": "The root cause of this vulnerability stems from insufficient input sanitization and inadequate output encoding within the request handling mechanisms of the Local Delivery Drivers for WooCommerce plugin. When the application processes incoming HTTP requests, user-supplied input parameters are improperly processed and subsequently reflected back into the Hypertext Markup Language (HTML) response without neutralizing executable script contexts. Because the vulnerable component lacks robust contextual output encoding, malicious scripts embedded within the input parameters are parsed and executed directly by the victim's web browser.\nThe attack flow begins when an unauthenticated remote attacker crafts a malicious Uniform Resource Locator (URL) containing an arbitrary JavaScript payload designed to execute within the Document Object Model (DOM) of the vulnerable site. The attacker then distributes this crafted link via phishing, social engineering, or direct injection vectors to target users or privileged administrators. Upon clicking or otherwise accessing the malicious URL, the victim's browser sends a request to the vulnerable endpoint running Local Delivery Drivers for WooCommerce <= 3.0.0. The server processes the request and responds with the unescaped payload embedded inside the HTML document.\nUpon receiving the response, the victim's browser executes the injected script within the security context of the origin site. Because the execution occurs locally within the browser, the payload inherits the session privileges of the victim. If the victim happens to possess administrative privileges, the script can perform high-privilege operations such as creating new rogue administrator accounts, modifying plugin configurations, or exfiltrating sensitive database contents via asynchronous HTTP requests. The network exposure is public-facing by default, requiring no special privileges or authentication headers to trigger the vulnerable code path."
}