What is the CVSS score of CVE-2026-66655?

CVE-2026-66655 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

Which versions of MultiParcels Shipping For WooCommerce are affected by CVE-2026-66655?

MultiParcels Shipping For WooCommerce plugin (versions ≤ 1.30.36) contains a reflected XSS vulnerability that allows unauthenticated attackers to compromise WordPress administrative sessions through…

How to fix or mitigate CVE-2026-66655?

Within 24 hours, identify all WordPress installations running MultiParcels Shipping ≤ 1.30.36 and disable the plugin or restrict access to trusted administrators only; note that while no public exploit identified at time of analysis, the changed-scope nature of this XSS means it can hijack authenticated admin sessions and audit recent access logs for indicators of compromise. Within 7 days, update to the latest available version of the plugin (confirm with vendor if version 1.30.37 or later addresses this CVE), implement input validation controls, and deploy Web Application Firewall (WAF) rules to block common XSS payloads on WordPress paths. Within 30 days, establish ongoing vulnerability monitoring for this plugin, conduct staff security awareness training on phishing and social engineering tactics used to deliver malicious links, and develop a plugin inventory management process to prevent similar vulnerabilities from persisting in production.

MultiParcels Shipping For WooCommerce CVE-2026-66655

EUVD-2026-57894 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-08-13 Patchstack

GHSA-wfgq-xc9g-5v4q

WordPress XSS Wordpress Plugin Multiparcels Shipping For Woocommerce Multiparcels

7.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

6.1 MEDIUM

Network-delivered reflected XSS requires no auth (PR:N) and changes scope to victim browser (S:C); availability impact removed as reflected XSS does not disrupt server-side service.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Aug 13, 2026 - 14:29 vuln.today

CVE Published

Aug 13, 2026 - 13:37 cve.org

HIGH 7.1

DescriptionCVE.org

Unauthenticated Cross Site Scripting (XSS) in MultiParcels Shipping For WooCommerce <= 1.30.36 versions.

AnalysisAI

Reflected Cross-Site Scripting in the MultiParcels Shipping For WooCommerce WordPress plugin (versions ≤ 1.30.36) enables unauthenticated attackers to inject and execute arbitrary JavaScript in a victim's browser by tricking them into following a crafted URL. The changed-scope vector (S:C) means the injected script runs within the victim's authenticated WordPress origin, enabling session hijacking, credential harvesting, or unauthorized administrative actions if an admin-level user is targeted. No public exploit code has been identified at time of analysis, and the vulnerability does not appear in the CISA KEV catalog.

Technical ContextAI

CWE-79 (Improper Neutralization of Input During Web Page Generation) identifies the root cause as insufficient sanitization or output encoding of attacker-controlled input before it is reflected in the HTTP response. The affected component is the MultiParcels Shipping For WooCommerce plugin (CPE: cpe:2.3:a:multiparcels:multiparcels_shipping_for_woocommerce:*:*:*:*:*:*:*:*), a WooCommerce extension that provides multi-carrier parcel tracking, shipping label generation, and delivery management for WordPress e-commerce sites. Unlike stored XSS - where the payload persists in a database - reflected XSS requires the victim to actively request a URL containing the malicious payload, which the plugin then echoes verbatim into the rendered HTML response. The S:C (Scope Changed) metric in the CVSS vector confirms the script executes in the browser's security context of the WordPress site rather than remaining within the plugin's own processing scope, enabling cross-origin actions against the victim's authenticated session.

RemediationAI

The primary remediation is to update the MultiParcels Shipping For WooCommerce plugin to a version above 1.30.36 through the WordPress plugin dashboard or directly from the WordPress plugin repository. The exact patched release version must be verified via the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/multiparcels-shipping-for-woocommerce/vulnerability/wordpress-multiparcels-shipping-for-woocommerce-plugin-1-30-36-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve, as no specific fixed version number was present in the available data. If patching is not immediately possible, temporarily deactivating the plugin eliminates the attack surface entirely, at the cost of disabling all MultiParcels shipping functionality for the store. As a compensating control short of plugin deactivation, deploying a Web Application Firewall with XSS filtering rules (such as Cloudflare WAF, Wordfence, or Patchstack's virtual patching service) can intercept crafted payloads in reflected parameters; however, WAF rules are bypassable and should not substitute for patching. Site administrators should also train staff to recognize phishing URLs, as user interaction is a mandatory precondition for exploitation.