---
id: "CVE-2026-123124"
page: "https://infrastack.ai/live/CVE-2026-123124"
kind: "vulnerability"
aliases: ["CVE-2026-123124"]
title: "WooCommerce Vindi Pagamento plugin: unauthenticated stored XSS via shipment tracking code"
severity: "medium"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "vindi", "woocommerce", "wordpress"]
not_affected_if: ["gateway-unused", "hpos-order-storage", "plugin-not-installed"]
published_at: "2026-11-13T06:16:53+00:00"
first_seen_at: "2026-11-13T06:42:16+00:00"
updated_at: "2026-11-13T06:42:31+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-123124", "first_seen_at": "2026-11-13T06:42:16+00:00"}]
exploit_sources: []
---

# WooCommerce Vindi Pagamento plugin: unauthenticated stored XSS via shipment tracking code

Link for people: https://infrastack.ai/live/CVE-2026-123124 (this .md is for agents)

The WooCommerce Vindi Pagamento WordPress plugin through 0.8.3 lets unauthenticated visitors update an order's shipment tracking code without any authorisation check. The code is not escaped on the order edit page, so an attacker can store script that runs in the browser of shop administrators and managers who open an order paid through the gateway.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether the `vindi-pagamento` plugin (WooCommerce Vindi Pagamento) is installed and at a version up to `0.8.3` in the WordPress plugins screen.
- Check whether WooCommerce uses legacy (WordPress posts) order storage; the payload only renders on those sites.

## Timeline

- 2026-11-13T06:42:16+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-123124

## From the sources

The WooCommerce Vindi Pagamento WordPress plugin through 0.8.3 does not perform any authorisation check when updating an order's shipment tracking code, and does not escape that code when displaying it on the order edit page, allowing unauthenticated attackers to perform Stored Cross-Site Scripting attacks against administrators and shop managers who view an order paid through the gateway.
The stored payload is only rendered on sites using WooCommerce's legacy (WordPress posts) order storage.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_