CVE-2026-87786: Dewa Kirim <= 1.0.0 - Unauthenticated Stored XSS via Checkout Coordinates
The Dewa Kirim WordPress plugin through 1.0.0 does not escape delivery coordinates submitted at checkout before outputting them inside an inline script, allowing unauthenticated users to store JavaScript that runs in the session of an administrator who later opens the order.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An unauthenticated user can submit malicious delivery-coordinate values during checkout. The payload executes only when an administrator later opens the affected order.
What conditions are required for exploitation?
The attacker needs access to the checkout flow and must be able to supply delivery coordinates. An administrator must subsequently view the stored order for the injected JavaScript to run.
How can I determine whether an order may be affected?
Review checkout orders for unexpected or suspicious content in stored delivery-coordinate fields, particularly orders created by untrusted users. Opening a suspected order may trigger stored JavaScript in an administrator session.