CyberRota Analysis
AI-GeneratedThe Dewa Kirim WordPress plugin versions up to 1.0.0 are vulnerable due to inadequate escaping of delivery coordinates, enabling unauthenticated users to inject malicious JavaScript into the session of an administrator when they access the order. This vulnerability can lead to session hijacking or other malicious actions executed in the context of the administrator's session. WordPress site administrators using this plugin should prioritize immediate updates to mitigate potential exploitation.
Original NVD Description
The Dewa Kirim WordPress plugin through 1.0.0 does not escape delivery coordinates submitted at checkout before outputting them inside an inline script, allowing unauthenticated users to store JavaScript that runs in the session of an administrator who later opens the order.