CVE-2026-66655

HighCVSS 7.1

Published: 13/08/2026(UTC)Updated: 14/08/2026(UTC)Translated: 13/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.18%

8th percentile - higher than 8% of all known CVEs

Summary

The MultiParcels Shipping For WooCommerce plugin version 1.30.36 and earlier contains an unauthenticated Cross Site Scripting (XSS) vulnerability. An attacker can inject a malicious script that executes in the victim's browser without requiring authentication.

Risk Assessment

The risk includes user session theft, account takeover, displaying fake content, or redirecting to malicious sites. This could lead to compromise of user data confidentiality.

Recommendation

It is recommended to update the MultiParcels Shipping For WooCommerce plugin to a version newer than 1.30.36. Also, apply input filtering and sanitization mechanisms.

Original NVD description (English source)

Unauthenticated Cross Site Scripting (XSS) in MultiParcels Shipping For WooCommerce <= 1.30.36 versions.