Dashboard / CVE-2026-123124

CVE-2026-123124

HIGH
MEDIUM Priority: 0.01 BB Relevance: 55/100
Published: 2026-11-13 Modified: 2026-11-13 First seen: 2026-11-13 Status: active

Attack Surface

Network No Auth Conf. Impact Integ. Impact

CVSS Vector Breakdown

AV: Network
AC: High
PR: None
UI: Required
S: Unchanged
C: High
I: High
A: High

Description

The WooCommerce Vindi Pagamento WordPress plugin through 0.8.3 does not perform any authorisation check when updating an order's shipment tracking code, and does not escape that code when displaying it on the order edit page, allowing unauthenticated attackers to perform Stored Cross-Site Scripting attacks against administrators and shop managers who view an order paid through the gateway. The stored payload is only rendered on sites using WooCommerce's legacy (WordPress posts) order storage.

Weakness Classification (1)

Affected Software (2)

VendorProductVersion
Unknown WooCommerce Vindi Pagamento 0
Unknown WooCommerce Vindi Pagamento 0

References & Advisories (1)

Bug Bounty Relevance

55 / 100
✓ Network accessible
✓ No authentication

CVSS Score

7.5 / 10.0 v3.1
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS — Exploitation Probability

0.17%
Raw Score 0.001730
Percentile 6.8%
Date 2026-11-13

Intelligence Sources

mitre ref →
nvd ref →

External Links