CVE-2023-3954
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk31th percentile - higher than 31% of all known CVEs
Summary
The MultiParcels Shipping For WooCommerce plugin before version 1.15.4 does not sanitize and escape a parameter before outputting it back on the page, leading to a Reflected Cross-Site Scripting vulnerability. This could be exploited against high privilege users such as admins.
Risk Assessment
This vulnerability poses a risk to the organization as an attacker could exploit it to perform XSS attacks on high privilege users, potentially leading to account takeover or exposure of sensitive information.
Recommendation
It is recommended to update the plugin to version 1.15.4 or later to mitigate this vulnerability. Additionally, conducting a security audit of the application to identify other potential vulnerabilities is advisable.
Other vulnerabilities in MultiParcels Shipping For WooCommerce
See all- CVE-2026-66655High
The MultiParcels Shipping For WooCommerce plugin version 1.30.36 and earlier contains an unauthenticated Cross Site Scripting (XSS) vulnerability. An attacker can inject a malicious script that executes in the victim's browser without requiring authentication.
- CVE-2023-3366Medium
The MultiParcels Shipping For WooCommerce plugin before version 1.15.2 lacks CSRF verification when deleting a shipment, allowing attackers to delete arbitrary shipments via a CSRF attack by any logged-in user.
- CVE-2023-3671Medium
The MultiParcels Shipping for WooCommerce plugin before version 1.15.4 does not sanitize and escape various parameters before outputting them back on the page, leading to a reflected Cross-Site Scripting (XSS) vulnerability. This can be exploited against high privilege users such as admins.
- CVE-2023-3365High
The MultiParcels Shipping For WooCommerce plugin before version 1.14.14 lacks authorization when deleting shipments, allowing any authenticated user, such as a subscriber, to delete arbitrary shipments.
Original NVD description (English source)
The MultiParcels Shipping For WooCommerce WordPress plugin before 1.15.4 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Vulnerability data from NVD (NIST) · CISA KEV · EPSS