Description

Unauthenticated Cross Site Scripting (XSS) in MultiParcels Shipping For WooCommerce <= 1.30.36 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-08-13T14:17:09.207Z",
  "pubdate": "2026-08-13T14:17:09.207Z",
  "executiveSummary": "An unauthenticated Cross-Site Scripting (XSS) vulnerability has been identified in the MultiParcels Shipping For WooCommerce plugin, specifically affecting versions <= 1.30.36. This security flaw enables remote attackers to inject malicious JavaScript payloads into vulnerable parameters processed by the application, which are subsequently rendered in the victim's browser context without proper sanitization or output encoding.\nThe primary impact of this vulnerability involves potential session hijacking, arbitrary script execution within the context of an authenticated user's session, redirection to malicious external sites, and defacement or manipulation of the rendered Document Object Model (DOM). Since the vulnerability is exploitable without authentication, any external threat actor can target visitors or administrators interacting with the vulnerable WordPress installation.\nRisk implications are significant as successful exploitation against privileged users, such as WordPress administrators, could lead to full site compromise by allowing attackers to create new administrative accounts, modify plugin code, or inject persistent backdoors. Mitigation requires immediate updating of the MultiParcels Shipping For WooCommerce plugin to a patched version once available, alongside the implementation of robust input validation and context-aware output encoding across all endpoints.",
  "technicalDetails": "The vulnerability resides within the MultiParcels Shipping For WooCommerce plugin for versions <= 1.30.36, stemming from insufficient input sanitization and a lack of output encoding on user-supplied parameters processed by the plugin's endpoints. Because the component fails to properly validate and escape incoming data before reflecting it back in the HTTP response, an attacker can craft malicious input containing executable JavaScript or HTML markup.\nExploitation of this vulnerability requires network exposure via HTTP/HTTPS, as the target WordPress site must be accessible to the attacker. Crucially, the attack vector is unauthenticated, meaning the attacker does not require valid credentials or prior interaction with the application to initiate the exploit. The attack flow generally involves the transmission of a crafted HTTP request containing the malicious payload targeting a vulnerable script or parameter handled by the plugin.\nUpon receiving the malicious request, the vulnerable component processes the input and includes it in the server response. When a victim's browser parses this response, the unescaped script payload executes within the context of the victim's session. If the victim is an administrative user, the script executes with elevated privileges, enabling the execution of administrative actions via the WordPress REST API or AJAX handlers without the user's consent.\nThe payload behavior can range from simple data exhumation, such as stealing session cookies and local storage tokens, to complex post-exploitation activities including DOM manipulation, keylogging, and the automated dispatch of unauthorized administrative requests. The root cause is categorized as improper neutralization of input during web page generation, leading to reflected or stored Cross-Site Scripting vectors depending on how the input is stored and retrieved by the affected shipping module."
}