CVE-2026-123124

UNKNOWN 0.0

WooCommerce Vindi Pagamento <= 0.8.3 - Unauthenticated Stored XSS via 'code' Parameter

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

The WooCommerce Vindi Pagamento WordPress plugin through 0.8.3 does not perform any authorisation check when updating an order's shipment tracking code, and does not escape that code when displaying it on the order edit page, allowing unauthenticated attackers to perform Stored Cross-Site Scripting attacks against administrators and shop managers who view an order paid through the gateway. The stored payload is only rendered on sites using WooCommerce's legacy (WordPress posts) order storage.

Vendor	unknown
Product	woocommerce vindi pagamento
Published	Nov 13, 2026

Stay Ahead of the Next One

Get instant alerts for unknown woocommerce vindi pagamento

Be the first to know when new unknown vulnerabilities affecting unknown woocommerce vindi pagamento are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

Unknown / WooCommerce Vindi Pagamento

0 ≤ 0.8.3

References

NVD ↗ CVE.org ↗ EPSS Data ↗

wpscan.com: https://wpscan.com/vulnerability/861d57fa-54dd-4980-8f0e-9d8a2874072f/

Credits

Enrico Marcolini Claudio Marchesini Dottor Marc WPScan