CVE-2026-124256: WordPress Delivery & Pickup Date Time for WooCommerce plugin <= 1.3.90 - Cross Site Scripting (XSS) vulnerability

Q: Who can exploit this issue?

An attacker needs network access, a low-privileged account, and user interaction. The available data indicates the issue can be exploited with low attack complexity.

Q: Are default installations affected?

The available data does not identify any non-default configuration requirement. It affects Delivery & Pickup Date Time for WooCommerce versions through 1.3.90.

Q: What is the likely impact if exploitation succeeds?

This is a stored XSS issue with low confidentiality, integrity, and availability impacts. Because the scope is changed, successful exploitation may affect a security authority beyond the vulnerable plugin's own context.

Published Nov 11, 2026

Updated

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CodeRockz Delivery & Pickup Date Time for WooCommerce woo-delivery allows Stored XSS.This issue affects Delivery & Pickup Date Time for WooCommerce: from n/a through 1.3.90.

Affected Software

1 affected component

CodeRockz Delivery & Pickup Date Time for WooCommerce<=1.3.90

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade CodeRockz Delivery & Pickup Date Time for WooCommerce (woo-delivery) to a version that resolves this vulnerability.
Fixed in 1.3.91

Event History

Nov 11, 2026

CVE Published

via MITRE·10:00 AM

Data Sourced

via MITRE·10:00 AM

RemedyDescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An attacker needs network access, a low-privileged account, and user interaction. The available data indicates the issue can be exploited with low attack complexity.

Are default installations affected?

The available data does not identify any non-default configuration requirement. It affects Delivery & Pickup Date Time for WooCommerce versions through 1.3.90.

What is the likely impact if exploitation succeeds?

This is a stored XSS issue with low confidentiality, integrity, and availability impacts. Because the scope is changed, successful exploitation may affect a security authority beyond the vulnerable plugin's own context.

CVE-2026-124256: WordPress Delivery & Pickup Date Time for WooCommerce plugin <= 1.3.90 - Cross Site Scripting (XSS) vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

Are default installations affected?

What is the likely impact if exploitation succeeds?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

Are default installations affected?

What is the likely impact if exploitation succeeds?