https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-09-28T16:25:28.078000+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/cve-2026-87786 CVE-2026-87786 — Dewa Kirim <= 1.0.0 - Unauthenticated Stored XSS via Checkout Coordinates 2026-09-28T16:25:28.079736+00:00

Affected: Unknown Dewa Kirim

The Dewa Kirim WordPress plugin through 1.0.0 does not escape delivery coordinates submitted at checkout before outputting them inside an inline script, allowing unauthenticated users to store JavaScript that runs in the session of an administrator who later opens the order.