CVE-2025-2929 — Cross-site Scripting in Order Delivery Date FOR Woocommerce

CWE-79 — Cross-site ScriptingCWE-770 — Allocation of Resources Without Limits or Throttling4 documents4 sources
Severity
7.1HIGHNVD
EPSS
0.2%
top 57.81%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Tychesoftwares Order Delivery Date FOR Woocommerce
Timeline
PublishedMay 20

Description

The Order Delivery Date WordPress plugin before 12.4.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:LExploitability: 2.8 | Impact: 3.7

Affected Packages1 packages

🔴Vulnerability Details

2
CVEList
Order Delivery Date Pro for WooCommerce < 12.4.0 - Reflected XSS↗2025-05-20
▶
GHSA
GHSA-jgch-gjvp-j2r8: The Order Delivery Date WordPress plugin before 12↗2025-05-20
▶

📋Vendor Advisories

1
Microsoft
DHCP memory leak↗2022-10-11
▶
CVE-2025-2929 — Cross-site Scripting | cvebase