UNKNOWN NVD

CVE-2026-87786

The Dewa Kirim WordPress plugin through 1.0.0 does not escape delivery coordinates submitted at checkout before outputting them inside an inline script, allowi

The Dewa Kirim WordPress plugin through 1.0.0 does not escape delivery coordinates submitted at checkout before outputting them inside an inline script, allowing unauthenticated users to store JavaScript that runs in the session of an administrator who later opens the order.

References

https://wpscan.com/vulnerability/bb94cded-6ec1-488e-8682-555d276d2979/

Published: 2026-09-17 · Source: NVD · Feed updated: 2026-09-17

This unknown severity vulnerability was published on 2026-09-17 via NVD.

vulnfeed aggregates 8294 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.