Reflected Cross-Site Scripting Vulnerability in GLS Shipping for WooCommerce by WordPress

CVE-2026-6417

What is CVE-2026-6417?

The GLS Shipping for WooCommerce plugin for WordPress has a vulnerability that allows untrusted input to be reflected back to the user without proper sanitization. This occurs through the 'failed_orders' parameter, enabling attackers to inject arbitrary JavaScript. When users unknowingly click on links crafted by the attacker, their browsers may execute harmful scripts that could compromise user sessions or redirect them to malicious sites. All versions of this plugin up to 1.4.0 are affected, highlighting the need for improved validation and sanitization processes to protect against such exploits.

References