CVE-2026-123124 · Package
NO FIX YET
The WooCommerce Vindi Pagamento WordPress plugin through 0.8.3 lets unauthenticated visitors update an order's shipment tracking code without any authorisation check. The code is not escaped on the order edit page, so an attacker can store script that runs in the browser of shop administrators and managers who open an order paid through the gateway.
first public Nov 13, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Shops running the WooCommerce Vindi Pagamento plugin through 0.8.3 with WooCommerce's legacy (WordPress posts) order storage are exposed. The stored payload renders when an administrator or shop manager views an order paid through the Vindi gateway. Sites on High-Performance Order Storage or without this plugin can skip it.
Not affected if gateway-unused, hpos-order-storage, plugin-not-installed
Who cares vindi, woocommerce, wordpress
vindi-pagamento plugin (WooCommerce Vindi Pagamento) is installed and at a version up to 0.8.3 in the WordPress plugins screen.No fix yet, per the sources.
The WooCommerce Vindi Pagamento WordPress plugin through 0.8.3 does not perform any authorisation check when updating an order's shipment tracking code, and does not escape that code when displaying it on the order edit page, allowing unauthenticated attackers to perform Stored Cross-Site Scripting attacks against administrators and shop managers who view an order paid through the gateway. The stored payload is only rendered on sites using WooCommerce's legacy (WordPress posts) order storage.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.