What is the CVSS score of CVE-2026-6417?

CVE-2026-6417 has a CVSS 3.1 base score of 6.1 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.1%.

GLS Shipping WooCommerce CVE-2026-6417

EUVD-2026-30236 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-05-14 security@wordfence.com

GHSA-9gf3-jf6q-c8r3

XSS WordPress

6.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.1 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 10:55 vuln.today

CVE Published

May 14, 2026 - 06:16 nvd

MEDIUM 6.1

DescriptionCVE.org

The GLS Shipping for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'failed_orders' parameter in all versions up to, and including, 1.4.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

AnalysisAI

Reflected Cross-Site Scripting in the GLS Shipping for WooCommerce WordPress plugin (all versions through 1.4.0) allows unauthenticated remote attackers to inject arbitrary JavaScript via the unsanitized 'failed_orders' parameter, executing in victims' browsers when they interact with a crafted link. The CVSS vector (PR:N, S:C) confirms no authentication is needed by the attacker, though user interaction is required, and the Changed scope rating means successful exploitation can affect resources beyond the plugin's own context - such as session tokens or other page content. No active exploitation is identified at time of analysis; EPSS stands at 0.06% (17th percentile) and CISA SSVC assigns exploitation status of 'none', making this a theoretical rather than emergent threat.

Technical ContextAI

CWE-79 (Improper Neutralization of Input During Web Page Generation) describes the root cause: the plugin reflects user-supplied input from the 'failed_orders' HTTP parameter directly into rendered HTML output without adequate sanitization or output encoding. This is a classic server-side reflection pattern where the malicious payload travels in a URL, is processed by WordPress/PHP, and is echoed back into the DOM. The Changed scope (S:C) in the CVSS vector is significant for WordPress plugins - because scripts execute in the browser under the origin of the hosting WordPress site, a successful XSS payload can access cookies, session tokens, or perform actions on behalf of any authenticated user who triggers it, including administrators. The affected product is the GLS Shipping for WooCommerce plugin, versions 0 through 1.4.0, a WooCommerce extension for integrating GLS parcel delivery logistics. No CPE string was provided, but the EUVD confirms the affected range as 'GLS Shipping for WooCommerce ≤ 1.4.0'.

RemediationAI

The primary remediation is to update the GLS Shipping for WooCommerce plugin beyond version 1.4.0. A code fix is available as WordPress plugin repository changeset 3459927 (https://plugins.trac.wordpress.org/changeset/3459927/gls-shipping-for-woocommerce#file48), which addresses the insufficient input sanitization and output escaping in the 'failed_orders' parameter. However, the exact patched release version number is not independently confirmed from the available data - site administrators should verify the current plugin version in the WordPress plugin directory and update to the latest available release. As a compensating control prior to patching, a Web Application Firewall (WAF) rule blocking reflected XSS patterns in the 'failed_orders' query parameter can reduce exposure; Wordfence (the reporter) provides firewall rules for its users. Note that WAF rules do not fix the underlying flaw and may be bypassed with encoding variations. The Wordfence advisory at the URL above is the authoritative source for further remediation guidance.