Stored Cross-Site Scripting Vulnerability in WooCommerce Vindi Pagamento Plugin
CVE-2026-123124

Currently unrated

Key Information:

Vendor

WordPress
Status
WooCommerce Vindi Pagamento
Vendor
CVE Published:
13 November 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-123124?

The WooCommerce Vindi Pagamento plugin version 0.8.3 lacks proper authorization checks when updating an order's shipment tracking code and fails to escape that information when displayed on the order edit page. This oversight allows unauthenticated users to exploit the vulnerability, facilitating Stored Cross-Site Scripting (XSS) attacks that can affect administrators and shop managers who view orders paid through the gateway. The executed payload poses a significant risk, particularly on sites using WooCommerce's legacy order storage based on WordPress posts.

Affected Version(s)

WooCommerce Vindi Pagamento 0 <= 0.8.3

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-123124 - Proof of Concept

References

https://wpscan.com/vulnerability/861d57fa-54dd-4980-8f0e-...
exploitvdb-entrytechnical-description

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Enrico Marcolini
Claudio Marchesini
Dottor Marc
WPScan
.