Product Delivery Date For Woocommerce
Monthly
Information disclosure in the Product Delivery Date for WooCommerce WordPress plugin before 3.3.2 allows an authenticated user with only Contributor-level access to read other customers' order details via the plugin's calendar-view AJAX actions, which are missing a capability check. Publicly available exploit code exists per WPScan, but EPSS is a low 0.15% (4th percentile) and there is no confirmed active exploitation (not listed in CISA KEV). Practical exposure is limited to WooCommerce stores that grant Contributor-or-higher accounts to untrusted or semi-trusted users, since a valid low-privilege login on the target site is required.
The Product Delivery Date for WooCommerce - Lite plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
Information disclosure in the Product Delivery Date for WooCommerce WordPress plugin before 3.3.2 allows an authenticated user with only Contributor-level access to read other customers' order details via the plugin's calendar-view AJAX actions, which are missing a capability check. Publicly available exploit code exists per WPScan, but EPSS is a low 0.15% (4th percentile) and there is no confirmed active exploitation (not listed in CISA KEV). Practical exposure is limited to WooCommerce stores that grant Contributor-or-higher accounts to untrusted or semi-trusted users, since a valid low-privilege login on the target site is required.
The Product Delivery Date for WooCommerce - Lite plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.