Description

Unauthenticated Cross Site Scripting (XSS) in Colissimo Officiel : Méthodes de livraison pour WooCommerce <= 2.10.0 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-08-13T14:17:10.647Z",
  "pubdate": "2026-08-13T14:17:10.647Z",
  "executiveSummary": "An unauthenticated Cross-Site Scripting (XSS) vulnerability has been identified in the Colissimo Officiel : Méthodes de livraison pour WooCommerce plugin. The flaw affects all versions up to and including 2.10.0.\nThe vulnerability allows remote, unauthenticated threat actors to inject malicious scripts, typically JavaScript, into vulnerable endpoints of the affected WordPress plugin. When rendered by a victim's browser, the injected payload executes within the context of the user's session.\nThe primary impact of this vulnerability includes potential session hijacking, unauthorized actions performed on behalf of administrative or standard users, redirection to malicious destinations, and defacement of the affected WooCommerce store pages.\nGiven that the vulnerability requires no authentication and can be exploited over the network via standard HTTP requests, the overall risk profile is significant. Exploitation conditions rely on user interaction in scenarios where the payload is executed within administrative panels, or automated execution if the injection reflects in front-end delivery method parameters.\nImmediate patching or updating past version 2.10.0 is critical to neutralize the exposure and prevent potential exploitation by malicious entities scanning for known WordPress plugin vulnerabilities.",
  "technicalDetails": "The vulnerability resides in the Colissimo Officiel : Méthodes de livraison pour WooCommerce plugin for WordPress, specifically affecting all versions up to and including 2.10.0.\nThe root cause stems from insufficient input sanitization and inadequate output encoding of user-supplied parameters handled by the plugin. Specifically, parameters processed during the handling of delivery methods or administrative requests fail to properly neutralize HTML and JavaScript control characters.\nAttackers exploit this flaw by crafting malicious HTTP requests containing arbitrary JavaScript payloads directed at the vulnerable endpoints exposed by the plugin. Because the component lacks proper context-aware output escaping, the malicious payload is reflected back in the HTTP response or stored persistently, depending on the vulnerable code path.\nThe attack flow proceeds as follows: First, the unauthenticated attacker identifies the vulnerable parameter within the Colissimo Officiel plugin. Second, the attacker crafts a specially formulated URL or HTTP POST request embedding the XSS payload. Third, the attacker induces a victim—such as an authenticated administrator or a customer interacting with the WooCommerce checkout/delivery module—to trigger the request or view the affected page. Finally, the browser parses the response, executes the injected script within the security context of the victim's active session, and compromises the session integrity.\nNetwork exposure is external, requiring HTTP/HTTPS access to the target WordPress installation running the vulnerable plugin. No prior authentication or specific user privileges are required to inject the payload, fulfilling the unauthenticated vector criteria.\nPost-exploitation impact depends on the target context. If executed against an administrator, the script can create new administrative accounts, install malicious plugins, or modify core site configurations. If executed against front-end users, session tokens or personal data displayed during the checkout process may be exfiltrated to attacker-controlled infrastructure."
}