The stored payload is only rendered on sites using WooCommerce's legacy (WordPress posts) order storage.
Analysis
Analysis and contextual insights are available on OpenCVE Cloud.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| Unknown | WooCommerce Vindi Pagamento | unknown |
|
No data.
No data.
No data available yet.
No solution or workaround provided in the CVE record.
Additional remediation guidance may be available on OpenCVE Cloud.
Tracking
Sign in to view the affected projects.
No advisories yet.
Fri, 13 Nov 2026 19:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Weaknesses | CWE-79 | |
| Metrics |
cvssV3_1
|
Fri, 13 Nov 2026 06:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | The WooCommerce Vindi Pagamento WordPress plugin through 0.8.3 does not perform any authorisation check when updating an order's shipment tracking code, and does not escape that code when displaying it on the order edit page, allowing unauthenticated attackers to perform Stored Cross-Site Scripting attacks against administrators and shop managers who view an order paid through the gateway. The stored payload is only rendered on sites using WooCommerce's legacy (WordPress posts) order storage. | |
| Title | WooCommerce Vindi Pagamento <= 0.8.3 - Unauthenticated Stored XSS via 'code' Parameter | |
| References |
|
Subscriptions
No data.
MITRE
Status: PUBLISHED
Assigner: WPScan
Published:
Updated: 2026-11-13T18:53:30.627Z
Reserved: 2026-11-05T13:04:03.458Z
Link: CVE-2026-123124
Vulnrichment
No data.
NVD
Status : Deferred
Published: 2026-11-13T06:16:53.487
Modified: 2026-11-13T19:19:18.620
Link: CVE-2026-123124
Redhat
No data.
OpenCVE Enrichment
No data.
-
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')