What’s Vulnerable › Vulnerabilities
CVE-2026-87786: Dewa Kirim <= 1.0.0 - Unauthenticated Stored XSS via Checkout Coordinates
- Severity: high (CVSS 8.8 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.5% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-09-17 · updated 2026-09-18
- Weakness: CWE-79
Description
The Dewa Kirim WordPress plugin through 1.0.0 does not escape delivery coordinates submitted at checkout before outputting them inside an inline script, allowing unauthenticated users to store JavaScript that runs in the session of an administrator who later opens the order.
Affected products
- Dewa Kirim: through 1.0.0
References
Get alerted when CVE-2026-87786 or the next vulnerability affects your stack