What is the CVSS score of CVE-2026-66468?

CVE-2026-66468 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

Which versions of Local Delivery Drivers are affected by CVE-2026-66468?

Local Delivery Drivers for WooCommerce versions 3.0.0 and below contain an unauthenticated persistent cross-site scripting vulnerability enabling attackers to inject malicious code into administrator…

How to fix or mitigate CVE-2026-66468?

Within 24 hours, conduct a comprehensive inventory of all WordPress installations to identify and document any deployments of Local Delivery Drivers for WooCommerce versions 3.0.0 and below. Within 7 days, disable and remove the vulnerable plugin from all affected WordPress sites, or if operationally necessary, implement Web Application Firewall rules to block unauthenticated XSS injection attempts targeting the plugin's delivery-related endpoints. Within 30 days, evaluate and deploy alternative delivery management solutions without known vulnerabilities, establish automated plugin vulnerability scanning in your deployment and change management processes, and document this incident to inform future security escalation procedures.

Local Delivery Drivers CVE-2026-66468

EUVD-2026-57887 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-08-13 Patchstack

GHSA-rc68-5g4f-j42f

WordPress XSS Wordpress Plugin Local Delivery Drivers For Woocommerce

7.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

6.1 MEDIUM

Network-accessible unauthenticated injection with browser-scope change justifies AV:N/PR:N/S:C; availability metric set to N as XSS does not disrupt service availability.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Aug 13, 2026 - 14:32 vuln.today

CVE Published

Aug 13, 2026 - 13:37 cve.org

HIGH 7.1

DescriptionCVE.org

Unauthenticated Cross Site Scripting (XSS) in Local Delivery Drivers for WooCommerce <= 3.0.0 versions.

AnalysisAI

Unauthenticated cross-site scripting in Local Delivery Drivers for WooCommerce 3.0.0 and below allows remote, unauthenticated attackers to inject persistent malicious scripts that execute in the browser context of authenticated site administrators or other privileged users. The changed scope (S:C) in the CVSS vector signals that successful exploitation crosses security boundaries beyond the plugin itself, enabling attacker access to administrator browser sessions. No public exploit code has been identified at time of analysis, and the vulnerability does not appear on the CISA Known Exploited Vulnerabilities catalog.

Technical ContextAI

The affected component is the Local Delivery Drivers for WooCommerce WordPress plugin developed by powerfulwp (CPE: cpe:2.3:a:powerfulwp:local_delivery_drivers_for_woocommerce:*:*:*:*:*:*:*:*), which extends WooCommerce to manage local delivery driver workflows including driver registration and assignment. CWE-79 (Improper Neutralization of Input During Web Page Generation) identifies the root cause: user-controlled input accepted from unauthenticated parties is not adequately sanitized or output-encoded before being rendered as HTML in the WordPress admin interface or front end. Because the attack vector is network-accessible and requires no credentials (PR:N in the CVSS vector), any external party capable of submitting data through an exposed plugin form can plant the malicious payload. The payload later executes in the victim's browser when privileged users view the tainted content, leveraging the browser as an unintended execution context outside the plugin's own trust boundary.

RemediationAI

The primary remediation is to update Local Delivery Drivers for WooCommerce to a version above 3.0.0; patch availability per vendor advisory should be confirmed at the Patchstack advisory URL https://patchstack.com/database/wordpress/plugin/local-delivery-drivers-for-woocommerce/vulnerability/wordpress-local-delivery-drivers-for-woocommerce-plugin-3-0-0-cross-site-scripting-xss-vulnerability, as no specific fixed version number was present in the available intelligence data. If an update is not yet available, site operators should consider deactivating the plugin entirely until a patch is published, accepting the trade-off of losing delivery driver management functionality. As a compensating control, deploying a web application firewall (WAF) with XSS filtering rules on input fields managed by this plugin can reduce injection success, though WAF rules may generate false positives on legitimate driver data. Implementing a strict Content Security Policy (CSP) header that disallows inline scripts (script-src 'self') limits the impact of any injected payload by preventing inline execution, but does not eliminate the underlying storage and rendering vulnerability. Restricting driver registration forms to authenticated users only - if operationally viable - removes the unauthenticated injection path.