{"id":"CVE-2026-123124","kind":"vulnerability","aliases":["CVE-2026-123124"],"related":[],"title":"WooCommerce Vindi Pagamento plugin: unauthenticated stored XSS via shipment tracking code","description":"The WooCommerce Vindi Pagamento WordPress plugin through 0.8.3 does not perform any authorisation check when updating an order's shipment tracking code, and does not escape that code when displaying it on the order edit page, allowing unauthenticated attackers to perform Stored Cross-Site Scripting attacks against administrators and shop managers who view an order paid through the gateway.\nThe stored payload is only rendered on sites using WooCommerce's legacy (WordPress posts) order storage.","summary":"The WooCommerce Vindi Pagamento WordPress plugin through 0.8.3 lets unauthenticated visitors update an order's shipment tracking code without any authorisation check. The code is not escaped on the order edit page, so an attacker can store script that runs in the browser of shop administrators and managers who open an order paid through the gateway.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","vindi","woocommerce","wordpress"],"not_affected_if":["gateway-unused","hpos-order-storage","plugin-not-installed"],"how_to_check":"- Check whether the `vindi-pagamento` plugin (WooCommerce Vindi Pagamento) is installed and at a version up to `0.8.3` in the WordPress plugins screen.\n- Check whether WooCommerce uses legacy (WordPress posts) order storage; the payload only renders on those sites.","fix":null,"status":"open","published_at":"2026-11-13T06:16:53+00:00","first_seen_at":"2026-11-13T06:42:16+00:00","triaged_at":"2026-11-13T06:42:31+00:00","updated_at":"2026-11-13T06:42:31+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-13T06:42:31Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"WooCommerce Vindi Pagamento plugin: unauthenticated stored XSS via shipment tracking code","impact":"medium","summary":"The WooCommerce Vindi Pagamento WordPress plugin through 0.8.3 lets unauthenticated visitors update an order's shipment tracking code without any authorisation check. The code is not escaped on the order edit page, so an attacker can store script that runs in the browser of shop administrators and managers who open an order paid through the gateway.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","woocommerce","vindi"],"confidence":0.7,"fix_status":"unknown","needs_auth":"no","worst_case":"script runs in admin browsers, hijacking staff sessions and store actions","analyst_note":"Confirm the fixed version of the Vindi Pagamento plugin on the WordPress.org plugin page or the NVD entry; no fix is stated in the sources.","how_to_check":"- Check whether the `vindi-pagamento` plugin (WooCommerce Vindi Pagamento) is installed and at a version up to `0.8.3` in the WordPress plugins screen.\n- Check whether WooCommerce uses legacy (WordPress posts) order storage; the payload only renders on those sites.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["plugin-not-installed","hpos-order-storage","gateway-unused"],"who_is_affected":"Shops running the WooCommerce Vindi Pagamento plugin through 0.8.3 with WooCommerce's legacy (WordPress posts) order storage are exposed. The stored payload renders when an administrator or shop manager views an order paid through the Vindi gateway. Sites on High-Performance Order Storage or without this plugin can skip it.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000805,"input_tokens":4614,"output_tokens":688,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-123124':14A,17A '-2026':13A,16A '0.8.3':29B,85C 'administr':67B,126C 'allow':114C 'attack':56B,116C,124C 'authoris':42B,90C 'browser':64B 'check':43B,91C 'code':11A,39B,45B,99C,105C 'cross':121C 'cross-sit':120C 'cve':12A,15A 'display':107C 'edit':52B,112C 'escap':48B,103C 'gateway':77B,137C 'legaci':149C 'let':30B 'manag':69B,129C 'open':71B 'order':35B,51B,73B,95C,111C,133C,152C 'packag':18B 'pagamento':3A,25B,81C 'page':53B,113C 'paid':74B,134C 'payload':140C 'perform':88C,118C 'plugin':4A,27B,83C 'post':151C 'render':143C 'run':61B 'script':59B,123C 'shipment':9A,37B,97C 'shop':66B,128C 'site':122C,145C 'storag':153C 'store':6A,58B,119C,139C 'track':10A,38B,98C 'unauthent':5A,31B,115C 'updat':33B,93C 'use':146C 'via':8A 'view':131C 'vindi':2A,19B,24B,80C 'visitor':32B 'without':40B 'woocommerc':1A,20B,23B,79C,147C 'wordpress':21B,26B,82C,150C 'xss':7A","nicknames":[],"mitigations":[],"who_affected":"Shops running the WooCommerce Vindi Pagamento plugin through 0.8.3 with WooCommerce's legacy (WordPress posts) order storage are exposed. The stored payload renders when an administrator or shop manager views an order paid through the Vindi gateway. Sites on High-Performance Order Storage or without this plugin can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","package","vindi","woocommerce","wordpress"],"campaign_type":null,"search_a":"'-123124':14A,17A '-2026':13A,16A 'code':11A 'cve':12A,15A 'pagamento':3A 'plugin':4A 'shipment':9A 'store':6A 'track':10A 'unauthent':5A 'via':8A 'vindi':2A 'woocommerc':1A 'xss':7A","search_b":"'0.8.3':29B 'administr':67B 'attack':56B 'authoris':42B 'browser':64B 'check':43B 'code':39B,45B 'edit':52B 'escap':48B 'gateway':77B 'let':30B 'manag':69B 'open':71B 'order':35B,51B,73B 'packag':18B 'pagamento':25B 'page':53B 'paid':74B 'plugin':27B 'run':61B 'script':59B 'shipment':37B 'shop':66B 'store':58B 'track':38B 'unauthent':31B 'updat':33B 'vindi':19B,24B 'visitor':32B 'without':40B 'woocommerc':20B,23B 'wordpress':21B,26B","search_c":"'0.8.3':85C 'administr':126C 'allow':114C 'attack':116C,124C 'authoris':90C 'check':91C 'code':99C,105C 'cross':121C 'cross-sit':120C 'display':107C 'edit':112C 'escap':103C 'gateway':137C 'legaci':149C 'manag':129C 'order':95C,111C,133C,152C 'pagamento':81C 'page':113C 'paid':134C 'payload':140C 'perform':88C,118C 'plugin':83C 'post':151C 'render':143C 'script':123C 'shipment':97C 'shop':128C 'site':122C,145C 'storag':153C 'store':119C,139C 'track':98C 'unauthent':115C 'updat':93C 'use':146C 'view':131C 'vindi':80C 'woocommerc':79C,147C 'wordpress':82C,150C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T06:16:53+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123124","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123124","severity":null,"published_at":"2026-11-13T06:16:53+00:00","modified_at":"2026-11-13T06:16:53+00:00","first_seen_at":"2026-11-13T06:42:16+00:00","fetched_at":"2026-11-13T06:42:16+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}