CVE-2026-66655: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in MultiParcels Shipping For WooCommerce = 1.30.36 versions...

CVE-2025-62995: Missing Authorization

Missing Authorization vulnerability in multiparcels MultiParcels Shipping For WooCommerce multiparcels-shipping-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MultiParcels Shipping For WooCommerce: from n/a through = 1.30.12...

PT-2024-24400

Name of the Vulnerable Software and Affected Versions MultiParcels Shipping For WooCommerce versions prior to 1.16.9 Description A Cross-Site Request Forgery CSRF issue affects the software, allowing unauthorized actions to be performed on behalf of a user without their knowledge. Recommendations...

CVE-2024-32095: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in MultiParcels MultiParcels Shipping For WooCommerce.This issue affects MultiParcels Shipping For WooCommerce: from n/a before 1.16.9...

CVE-2023-3366: Undefined Security Weakness

The MultiParcels Shipping For WooCommerce WordPress plugin before 1.15.2 does not have CRSF check when deleting a shipment, allowing attackers to make any logged in user, delete arbitrary shipment via a CSRF attack...

CVE-2023-3954: Improper Neutralization of Input During Web Page Generation

The MultiParcels Shipping For WooCommerce WordPress plugin before 1.15.4 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2023-3671: Undefined Security Weakness

The MultiParcels Shipping For WooCommerce WordPress plugin before 1.15.4 does not sanitise and escape various parameters before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

PT-2023-25688

Name of the Vulnerable Software and Affected Versions MultiParcels Shipping For WooCommerce WordPress plugin versions prior to 1.15.4 Description The issue is related to a Reflected Cross-Site Scripting problem. It occurs because the plugin does not properly sanitise and escape various parameters...

CVE-2023-3365: Undefined Security Weakness

The MultiParcels Shipping For WooCommerce WordPress plugin before 1.14.14 does not have authorisation when deleting shipment, allowing any authenticated users, such as subscriber to delete arbitrary shipment...

CVE-2023-2843: Undefined Security Weakness

The MultiParcels Shipping For WooCommerce WordPress plugin before 1.14.15 does not properly sanitize and escape a parameter before using it in an SQL statement, which could allow any authenticated users, such as subscribers, to perform SQL Injection attacks...