Dewa Kirim
Monthly
Stored cross-site scripting in the Dewa Kirim WordPress plugin through 1.0.0 allows an unauthenticated visitor to inject JavaScript through the delivery-coordinates field submitted during checkout, which is then written unescaped into an inline script and executes in the browser session of any administrator who later opens the affected order in wp-admin. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, 8.8) reflects that no authentication or special server configuration is required and the only friction is the user-interaction requirement: an admin must view the poisoned order for the payload to fire, after which a compromised admin session can lead to full site takeover. Publicly available exploit code exists, and although EPSS and KEV data were not provided, this is a credible high-priority issue within its niche install base given the unauthenticated injection path and the privileged target context.
Stored cross-site scripting in the Dewa Kirim WordPress plugin through 1.0.0 allows an unauthenticated visitor to inject JavaScript through the delivery-coordinates field submitted during checkout, which is then written unescaped into an inline script and executes in the browser session of any administrator who later opens the affected order in wp-admin. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, 8.8) reflects that no authentication or special server configuration is required and the only friction is the user-interaction requirement: an admin must view the poisoned order for the payload to fire, after which a compromised admin session can lead to full site takeover. Publicly available exploit code exists, and although EPSS and KEV data were not provided, this is a credible high-priority issue within its niche install base given the unauthenticated injection path and the privileged target context.