Executive brief
Dewa Kirim is a WordPress WooCommerce plugin for delivery coordination. Attackers can inject malicious JavaScript into delivery coordinates at checkout without authentication. When an administrator later reviews the order, the attacker's JavaScript executes in the admin's session, potentially allowing account takeover or unauthorized actions.
Technical details
This is a stored cross-site scripting (XSS) vulnerability (CWE-79) in the Dewa Kirim plugin version 1.0.0 and earlier. The vulnerable component fails to sanitize or escape delivery coordinates submitted via the checkout form before outputting them directly into an inline JavaScript context. The attack requires no authentication, allowing any unauthenticated user to inject the payload at checkout. When an administrator later accesses the affected order, the stored malicious script executes with the administrator's privileges. No fix is currently available for this vulnerability.
Affected products
- Dewa Kirim Dewa Kirim through 1.0.0
Timeline
- 2026-09-15: disclosed
- 2026-09-17: published