Cross-site Scripting Vulnerability in CodeRockz Delivery & Pickup Date Time for WooCommerce
CVE-2026-124256

6.5MEDIUM

Key Information:

Vendor

WordPress
Status
Delivery & Pickup Date Time For WooCommerce
Vendor
CVE Published:
11 November 2026

What is CVE-2026-124256?

A Cross-site Scripting (XSS) vulnerability has been identified in the CodeRockz Delivery & Pickup Date Time for WooCommerce plugin. This flaw arises from improper input neutralization during web page generation, leading to stored XSS. Attackers can exploit this vulnerability to inject malicious scripts, potentially impacting users who access affected pages. The vulnerability affects versions of the plugin up to 1.3.90, making it essential for users to apply security updates promptly to mitigate risks.

Affected Version(s)

Delivery &amp; Pickup Date Time for WooCommerce 0 <= 1.3.90

References

https://patchstack.com/database/wordpress/plugin/woo-deli...
vdb-entry

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

leon figueira | Patchstack Bug Bounty Program
.