MultiParcels Shipping For WooCommerce vulnerabilities
5 known CVE vulnerabilities in MultiParcels Shipping For WooCommerce, translated and rated.
- CVE-2026-66655High
The MultiParcels Shipping For WooCommerce plugin version 1.30.36 and earlier contains an unauthenticated Cross Site Scripting (XSS) vulnerability. An attacker can inject a malicious script that executes in the victim's browser without requiring authentication.
- CVE-2023-3954Medium
The MultiParcels Shipping For WooCommerce plugin before version 1.15.4 does not sanitize and escape a parameter before outputting it back on the page, leading to a Reflected Cross-Site Scripting vulnerability. This could be exploited against high privilege users such as admins.
- CVE-2023-3366Medium
The MultiParcels Shipping For WooCommerce plugin before version 1.15.2 lacks CSRF verification when deleting a shipment, allowing attackers to delete arbitrary shipments via a CSRF attack by any logged-in user.
- CVE-2023-3671Medium
The MultiParcels Shipping for WooCommerce plugin before version 1.15.4 does not sanitize and escape various parameters before outputting them back on the page, leading to a reflected Cross-Site Scripting (XSS) vulnerability. This can be exploited against high privilege users such as admins.
- CVE-2023-3365High
The MultiParcels Shipping For WooCommerce plugin before version 1.14.14 lacks authorization when deleting shipments, allowing any authenticated user, such as a subscriber, to delete arbitrary shipments.