{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-87786", "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", "state": "PUBLISHED", "assignerShortName": "WPScan", "dateReserved": "2026-09-09T09:23:17.417Z", "datePublished": "2026-09-17T06:00:11.189Z", "dateUpdated": "2026-09-17T06:00:11.189Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", "shortName": "WPScan", "dateUpdated": "2026-09-17T06:00:11.189Z"}, "title": "Dewa Kirim <= 1.0.0 - Unauthenticated Stored XSS via Checkout Coordinates", "problemTypes": [{"descriptions": [{"description": "CWE-79 Cross-Site Scripting (XSS)", "lang": "en", "type": "CWE"}]}], "affected": [{"vendor": "Unknown", "product": "Dewa Kirim", "versions": [{"status": "affected", "versionType": "semver", "version": "0", "lessThanOrEqual": "1.0.0"}], "defaultStatus": "unknown"}], "descriptions": [{"lang": "en", "value": "The Dewa Kirim WordPress plugin through 1.0.0 does not escape delivery coordinates submitted at checkout before outputting them inside an inline script, allowing unauthenticated users to store JavaScript that runs in the session of an administrator who later opens the order."}], "references": [{"url": "https://wpscan.com/vulnerability/bb94cded-6ec1-488e-8682-555d276d2979/", "tags": ["exploit", "vdb-entry", "technical-description"]}], "credits": [{"lang": "en", "value": "Pablo Gonz\u00e1lez P\u00e9rez", "type": "finder"}, {"lang": "en", "value": "Francisco Jos\u00e9 Ram\u00edrez Vicente", "type": "finder"}, {"lang": "en", "value": "and I\u00f1igo S\u00e1nchez Enciso", "type": "finder"}, {"lang": "en", "value": "WPScan", "type": "coordinator"}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "WPScan CVE Generator"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unknown", "product": "Dewa Kirim", "vendor": "Unknown", "versions": [{"lessThanOrEqual": "1.0.0", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "contact@wpscan.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Dewa Kirim WordPress plugin through 1.0.0 does not escape delivery coordinates submitted at checkout before outputting them inside an inline script, allowing unauthenticated users to store JavaScript that runs in the session of an administrator who later opens the order."}], "id": "CVE-2026-87786", "lastModified": "2026-09-17T06:16:51.773", "metrics": {}, "published": "2026-09-17T06:16:51.773", "references": [{"source": "contact@wpscan.com", "url": "https://wpscan.com/vulnerability/bb94cded-6ec1-488e-8682-555d276d2979/"}], "sourceIdentifier": "contact@wpscan.com", "vulnStatus": "Received"}

{}

{}