CVE-2026-104313 in WPC Estimated Delivery Date Plugin
Summary
by MITRE • 10/03/2026
The WPC Estimated Delivery Date for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'rule_data' parameter in all versions up to, and including, 4.0.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/03/2026
The WPC Estimated Delivery Date plugin, widely utilized within the WordPress ecosystem to manage shipping expectations by displaying calculated delivery dates based on various rules, contains a critical security flaw identified in versions up through 4.0.1. This vulnerability manifests as a Reflected Cross-Site Scripting issue centered specifically around the rule_data parameter. The root cause lies in insufficient input sanitization and output escaping mechanisms within the plugin's codebase. When user-supplied data is processed, the application fails to adequately validate or encode this information before rendering it back into the browser context. This lack of rigorous validation allows malicious actors to inject arbitrary web scripts directly into HTTP responses that are subsequently executed by the victim's web browser upon viewing the affected page.
From a technical perspective, reflected cross-site scripting differs from stored variants in that the malicious payload is not permanently saved within the target application but rather appears immediately in the server response as part of the request parameters. In this specific instance, an unauthenticated attacker can craft a specially constructed URL containing JavaScript code embedded within the rule_data parameter. When a legitimate user clicks on this link or is otherwise tricked into loading it, their browser interprets and executes the injected script within the context of the vulnerable website. This execution environment grants the malicious script access to all cookies, session tokens, and other sensitive data associated with that domain, effectively bypassing same-origin policy protections designed to isolate web applications from one another.
The operational impact of this vulnerability is significant due to its potential for exploitation by unauthenticated attackers. Since no authentication credentials are required to trigger the flaw, the attack surface is broadened considerably compared to vulnerabilities requiring user login. Successful exploitation can lead to session hijacking, where an attacker steals a valid user's session token to impersonate them within the WordPress admin dashboard or storefront interface. Furthermore, the injected script can perform actions on behalf of the victim without their knowledge, such as modifying settings, creating new administrative users, or exfiltrating sensitive customer and order data stored in cookies. This compromises the confidentiality, integrity, and availability of the web application and its associated business logic.
In terms of industry standard classifications, this vulnerability aligns with CWE-79, which describes Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting. The specific vector reflects a failure to sanitize user input before outputting it to the browser, violating fundamental web security principles regarding data validation and encoding. Additionally, from an offensive cybersecurity framework perspective such as MITRE ATT&CK, this vulnerability facilitates techniques related to Client-Side Injection (T1059) and potentially Credential Access via Browser Session Hijacking if session tokens are successfully captured. The unauthenticated nature of the exploit also relates broadly to improper access control mechanisms that fail to restrict sensitive operations or data exposure based on user privilege levels.
Mitigation strategies for this vulnerability involve both immediate remediation steps and long-term security hygiene practices. Administrators running affected versions should immediately update the WPC Estimated Delivery Date plugin to version 4.0.2 or later, where these sanitization and escaping issues have been addressed by the developers. Until an update is applied, administrators can implement a Web Application Firewall rule to detect and block requests containing common script injection patterns within the rule_data parameter, although this serves only as a compensating control rather than a complete fix. Developers should ensure that all user-supplied data undergoes strict validation against expected formats and types before processing. Furthermore, output encoding must be applied contextually; for HTML contexts, entities such as ampersands and quotes must be encoded to prevent browser interpretation of injected tags. Regular security audits and static code analysis tools can help identify similar flaws in future development cycles, ensuring that input sanitization remains a core component of the software lifecycle rather than an afterthought.