EUVD-2026-57879
GHSA-vrxg-jj52-cf9v
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
PR:L reflects the mandatory subscriber account; S:C captures cross-user script execution; A:N because XSS does not meaningfully impact service availability.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
Lifecycle Timeline
1DescriptionCVE.org
Subscriber Cross Site Scripting (XSS) in AfterShip Tracking <= 1.18.1 versions.
AnalysisAI
Cross-site scripting in the AfterShip Tracking WordPress plugin (versions ≤ 1.18.1) enables subscriber-level authenticated users to inject malicious scripts that execute in the browsers of other site visitors or administrators. The CVSS scope change (S:C) confirms the injected payload executes outside the attacker's own session context, making administrator session hijacking the primary impact. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis.
Technical ContextAI
AfterShip Tracking is a WooCommerce-integrated WordPress plugin (CPE: cpe:2.3:a:aftership_&_automizely:aftership_tracking) that enables e-commerce stores to display parcel tracking information to customers. CWE-79 (Improper Neutralization of Input During Web Page Generation) identifies the root cause: user-controlled input processed by the plugin is insufficiently sanitized or HTML-escaped before being rendered in page output. The 'Subscriber' qualifier in the vulnerability title indicates that the injection point is accessible to WordPress users holding the subscriber role - the lowest authenticated WordPress role, typically assigned automatically to customers on WooCommerce stores with open registration. The CVSS scope change (S:C) is technically significant: the injected script executes in a security context broader than the attacker's subscriber session, most critically targeting administrator-level users who view the affected page.
RemediationAI
Update the AfterShip Tracking plugin to a version beyond 1.18.1 as soon as a patched release is available via the WordPress plugin repository or the vendor - the exact remediated version should be verified directly from the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/aftership-woocommerce-tracking/vulnerability/wordpress-aftership-tracking-plugin-1-18-1-cross-site-scripting-xss-vulnerability prior to deployment. If an immediate update is not possible, disable open user registration under WordPress Settings > General to eliminate the self-registration path for attackers; note this trade-off prevents new customer accounts from being created automatically. As a secondary compensating control, a WAF rule filtering common XSS payloads in plugin-related request parameters can reduce exploitation likelihood, though sophisticated obfuscation may bypass signature-based rules. Existing subscriber accounts on sites with closed registration still represent a residual risk and should be reviewed.
More in Wordpress Plugin
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
Remote code execution in the WP Query Console WordPress plugin (versions up to and including 1.0) by Ajit Bohra allows u
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today