Vulnerabilities

TI-2025-02570 CVE-2025-2942 · GHSA-q4cf-5v5q-g7jw

Order Delivery Date Pro for WooCommerce < 12.6.0 - Unauthenticated Arbitrary Post Title Disclosure

MEDIUM 53

The Order Delivery Date WordPress plugin before 12.6.0 discloses arbitrary post title (such as from draft and private posts) via an unauthenticated AJAX action, allowing attackers to retrieve such information

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.00299 Published 2025-07-11 Fixed in 12.6.0

TI-2025-02560 CVE-2025-2929 · GHSA-jgch-gjvp-j2r8

Order Delivery Date Pro for WooCommerce < 12.4.0 - Reflected XSS

MEDIUM 64

The Order Delivery Date WordPress plugin before 12.4.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privileg…

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00266 Published 2025-05-20 Fixed in 12.4.0 CWE-79

TI-2023-22251 CVE-2023-41858 · GHSA-522x-wr8w-r94g

WordPress Order Delivery Date for WP e-Commerce Plugin <= 1.2 is vulnerable to Cross Site Request Forgery (CSRF)

LOW 38

Cross-Site Request Forgery (CSRF) vulnerability in Ashok Rane Order Delivery Date for WP e-Commerce plugin <= 1.2 versions.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00259 Published 2023-10-10 No fix listed CWE-352

TI-2023-22267 CVE-2023-41874 · GHSA-h9mm-g94f-jv7h

WordPress Order Delivery Date for WooCommerce Plugin <= 3.20.0 is vulnerable to Cross Site Scripting (XSS)

LOW 31

Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Tyche Softwares Order Delivery Date for WooCommerce plugin <= 3.20.0 versions.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00406 Published 2023-09-25 No fix listed CWE-79

Vulnerabilities

Filters

Order Delivery Date Pro for WooCommerce < 12.6.0 - Unauthenticated Arbitrary Post Title Disclosure

Order Delivery Date Pro for WooCommerce < 12.4.0 - Reflected XSS

WordPress Order Delivery Date for WP e-Commerce Plugin <= 1.2 is vulnerable to Cross Site Request Forgery (CSRF)

WordPress Order Delivery Date for WooCommerce Plugin <= 3.20.0 is vulnerable to Cross Site Scripting (XSS)