Dewa Kirim EUVD-2026-81344

Requires the Dewa Kirim plugin (through 1.0.0) active on a WordPress site with a reachable checkout flow that captures delivery coordinates; the attacker needs no authentication and simply submits a malicious value in the delivery-coordinates field. The single limiting factor is UI:R - the payload does not fire until an administrator (or privileged user) later opens the affected order in wp-admin, so exploitation depends on that human action; no special server configuration is otherwise needed against a default install of the plugin.

This is a genuine priority within its (niche) install base. The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (8.8) reflects an unauthenticated (PR:N), network-reachable (AV:N), low-complexity (AC:L) stored XSS whose only gating factor is UI:R - an administrator must later open the malicious order in wp-admin. A public exploit exists (WPScan/EUVD), which raises practical risk, but POC availability is NOT active exploitation: there is no CISA KEV entry and no EPSS score was provided, so exploitation is best treated as plausible-but-unproven rather than widespread. The C:H/I:H/A:H impact triad is defensible for admin-session XSS (script running as an administrator can create rogue admins, install plugins, and achieve full site takeover), though it is somewhat generous for XSS and depends on the admin viewing the poisoned order; S:U is arguably understated since the payload executes in the admin's browser context rather than the injecting user's. Net: high impact and trivial injection, tempered by the required admin interaction and the plugin's small footprint - targeted opportunistic abuse is more likely than mass automated exploitation.

An unauthenticated attacker places or simulates a WooCommerce/checkout order on a site running Dewa Kirim ≤1.0.0, entering a JavaScript payload into the delivery-coordinates field instead of a valid location. The payload is stored unescaped and later rendered inside an inline <script> when an administrator opens the order in the WordPress dashboard, executing attacker JavaScript in the admin session (e.g., creating a new administrator or planting a webshell). A public proof-of-concept is available via WPScan.