CVE-2026-87786 — Dewa Kirim <= 1.0.0 - Unauthenticated Stored XSS via Checkout Coordinates

CVE-2026-87786

Dewa Kirim <= 1.0.0 - Unauthenticated Stored XSS via Checkout Coordinates PUBLISHED

Description (CNA)

The Dewa Kirim WordPress plugin through 1.0.0 does not escape delivery coordinates submitted at checkout before outputting them inside an inline script, allowing unauthenticated users to store JavaScript that runs in the session of an administrator who later opens the order.

Affected (CNA)

Vendor / product	Versions
Unknown / Dewa Kirim	affected 0 through 1.0.0

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/bb94cded-6ec1-488e-8682-555d276d2979/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.