{"api_version":"1","generated_at":"2026-09-17T07:50:02+00:00","cve":"CVE-2026-87786","urls":{"html":"https://cve.report/CVE-2026-87786","api":"https://cve.report/api/cve/CVE-2026-87786.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-87786","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-87786"},"summary":{"title":"Dewa Kirim <= 1.0.0 - Unauthenticated Stored XSS via Checkout Coordinates","description":"The Dewa Kirim  WordPress plugin through 1.0.0 does not escape delivery coordinates submitted at checkout before outputting them inside an inline script, allowing unauthenticated users to store JavaScript that runs in the session of an administrator who later opens the order.","state":"PUBLISHED","assigner":"WPScan","published_at":"2026-09-17 06:16:51","updated_at":"2026-09-17 06:16:51"},"problem_types":["CWE-79 Cross-Site Scripting (XSS)"],"metrics":[],"references":[{"url":"https://wpscan.com/vulnerability/bb94cded-6ec1-488e-8682-555d276d2979/","name":"https://wpscan.com/vulnerability/bb94cded-6ec1-488e-8682-555d276d2979/","refsource":"contact@wpscan.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-87786","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87786","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Unknown","product":"Dewa Kirim","version":"affected 1.0.0 semver","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[{"source":"CNA","value":"Pablo González Pérez","lang":"en"},{"source":"CNA","value":"Francisco José Ramírez Vicente","lang":"en"},{"source":"CNA","value":"and Iñigo Sánchez Enciso","lang":"en"},{"source":"CNA","value":"WPScan","lang":"en"}],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"defaultStatus":"unknown","product":"Dewa Kirim","vendor":"Unknown","versions":[{"lessThanOrEqual":"1.0.0","status":"affected","version":"0","versionType":"semver"}]}],"credits":[{"lang":"en","type":"finder","value":"Pablo González Pérez"},{"lang":"en","type":"finder","value":"Francisco José Ramírez Vicente"},{"lang":"en","type":"finder","value":"and Iñigo Sánchez Enciso"},{"lang":"en","type":"coordinator","value":"WPScan"}],"descriptions":[{"lang":"en","value":"The Dewa Kirim  WordPress plugin through 1.0.0 does not escape delivery coordinates submitted at checkout before outputting them inside an inline script, allowing unauthenticated users to store JavaScript that runs in the session of an administrator who later opens the order."}],"problemTypes":[{"descriptions":[{"description":"CWE-79 Cross-Site Scripting (XSS)","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-09-17T06:00:11.189Z","orgId":"1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81","shortName":"WPScan"},"references":[{"tags":["exploit","vdb-entry","technical-description"],"url":"https://wpscan.com/vulnerability/bb94cded-6ec1-488e-8682-555d276d2979/"}],"source":{"discovery":"EXTERNAL"},"title":"Dewa Kirim <= 1.0.0 - Unauthenticated Stored XSS via Checkout Coordinates","x_generator":{"engine":"WPScan CVE Generator"}}},"cveMetadata":{"assignerOrgId":"1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81","assignerShortName":"WPScan","cveId":"CVE-2026-87786","datePublished":"2026-09-17T06:00:11.189Z","dateReserved":"2026-09-09T09:23:17.417Z","dateUpdated":"2026-09-17T06:00:11.189Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-09-17 06:16:51","lastModifiedDate":"2026-09-17 06:16:51","problem_types":["CWE-79 Cross-Site Scripting (XSS)"],"metrics":[],"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"87786","Ordinal":"1","Title":"Dewa Kirim <= 1.0.0 - Unauthenticated Stored XSS via Checkout Co","CVE":"CVE-2026-87786","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"87786","Ordinal":"1","NoteData":"The Dewa Kirim  WordPress plugin through 1.0.0 does not escape delivery coordinates submitted at checkout before outputting them inside an inline script, allowing unauthenticated users to store JavaScript that runs in the session of an administrator who later opens the order.","Type":"Description","Title":"Dewa Kirim <= 1.0.0 - Unauthenticated Stored XSS via Checkout Co"}]}}}