CVE-2026-66655
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
The MultiParcels Shipping For WooCommerce plugin version 1.30.36 and earlier contains an unauthenticated Cross Site Scripting (XSS) vulnerability. An attacker can inject a malicious script that executes in the victim's browser without requiring authentication.
Risk Assessment
The risk includes user session theft, account takeover, displaying fake content, or redirecting to malicious sites. This could lead to compromise of user data confidentiality.
Recommendation
It is recommended to update the MultiParcels Shipping For WooCommerce plugin to a version newer than 1.30.36. Also, apply input filtering and sanitization mechanisms.
Other vulnerabilities in MultiParcels Shipping For WooCommerce
See all- CVE-2025-62995Medium
The MultiParcels Shipping For WooCommerce plugin up to version 1.30.12 has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels.
- CVE-2023-3954Medium
The MultiParcels Shipping For WooCommerce plugin before version 1.15.4 does not sanitize and escape a parameter before outputting it back on the page, leading to a Reflected Cross-Site Scripting vulnerability. This could be exploited against high privilege users such as admins.
- CVE-2023-3366Medium
The MultiParcels Shipping For WooCommerce plugin before version 1.15.2 lacks CSRF verification when deleting a shipment, allowing attackers to delete arbitrary shipments via a CSRF attack by any logged-in user.
- CVE-2023-3671Medium
The MultiParcels Shipping for WooCommerce plugin before version 1.15.4 does not sanitize and escape various parameters before outputting them back on the page, leading to a reflected Cross-Site Scripting (XSS) vulnerability. This can be exploited against high privilege users such as admins.
- CVE-2023-3365High
The MultiParcels Shipping For WooCommerce plugin before version 1.14.14 lacks authorization when deleting shipments, allowing any authenticated user, such as a subscriber, to delete arbitrary shipments.
Original NVD description (English source)
Unauthenticated Cross Site Scripting (XSS) in MultiParcels Shipping For WooCommerce <= 1.30.36 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS