Vulnerabilities

TI-2026-47326 CVE-2026-66655 · GHSA-wfgq-xc9g-5v4q

WordPress MultiParcels Shipping For WooCommerce plugin <= 1.30.36 - Reflected Cross Site Scripting (XSS) vulnerability

LOW 31

Unauthenticated Cross Site Scripting (XSS) in MultiParcels Shipping For WooCommerce <= 1.30.36 versions.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00251 Published 2026-08-13 No fix listed CWE-79

TI-2025-39143 CVE-2025-62995 · GHSA-fh3g-f46g-5wj4

WordPress MultiParcels Shipping For WooCommerce plugin <= 1.30.12 - Broken Access Control vulnerability

LOW 19

Missing Authorization vulnerability in multiparcels MultiParcels Shipping For WooCommerce multiparcels-shipping-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects M…

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.0022 Published 2025-12-09 No fix listed CWE-862

TI-2024-21172 CVE-2024-32095 · GHSA-h4cv-c3rm-v5ff

WordPress MultiParcels Shipping For WooCommerce plugin < 1.16.9 - Cross Site Request Forgery (CSRF) vulnerability

LOW 19

Cross-Site Request Forgery (CSRF) vulnerability in MultiParcels MultiParcels Shipping For WooCommerce.This issue affects MultiParcels Shipping For WooCommerce: from n/a before 1.16.9.

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.00212 Published 2024-04-15 Fixed in 1.16.9 CWE-352

TI-2023-03149 CVE-2023-3366 · GHSA-rjhf-7g74-c4qg

MultiParcels Shipping For WooCommerce < 1.15.2 - Arbitrary Shipment Deletion via CSRF

MEDIUM 53

The MultiParcels Shipping For WooCommerce WordPress plugin before 1.15.2 does not have CRSF check when deleting a shipment, allowing attackers to make any logged in user, delete arbitrary shipment via a CSRF attack

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.00267 Published 2023-08-21 Fixed in 1.15.2

TI-2023-03673 CVE-2023-3954 · GHSA-ccq7-hh37-hcx6

MultiParcels Shipping For WooCommerce 1.15.2-1.15.3 - Reflected XSS

MEDIUM 60

The MultiParcels Shipping For WooCommerce WordPress plugin before 1.15.4 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used aga…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00458 Published 2023-08-21 Fixed in 1.15.4 CWE-79

TI-2023-02664 CVE-2023-2843 · GHSA-j9wp-57cc-qx5c

MultiParcels Shipping For WooCommerce < 1.14.15 - Subscribers+ SQLi

HIGH 73

The MultiParcels Shipping For WooCommerce WordPress plugin before 1.14.15 does not properly sanitize and escape a parameter before using it in an SQL statement, which could allow any authenticated users, such as subscrib…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00872 Published 2023-08-07 Fixed in 1.14.15

TI-2023-03428 CVE-2023-3671 · GHSA-4f4q-pprq-947q

MultiParcels Shipping For WooCommerce < 1.15.4 - Reflected XSS

MEDIUM 60

The MultiParcels Shipping For WooCommerce WordPress plugin before 1.15.4 does not sanitise and escape various parameters before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be u…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00458 Published 2023-08-07 Fixed in 1.15.4

TI-2023-03148 CVE-2023-3365 · GHSA-wgqf-88gq-8wjm

MultiParcels Shipping For WooCommerce < 1.14.14 - Subscriber+ Arbitrary Shipment Deletion

HIGH 68

The MultiParcels Shipping For WooCommerce WordPress plugin before 1.14.14 does not have authorisation when deleting shipment, allowing any authenticated users, such as subscriber to delete arbitrary shipment

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00745 Published 2023-08-07 Fixed in 1.14.14

Vulnerabilities

Filters