The Morkva UA Shipping plugin accepts user input in the "Weight, kg" field without proper sanitization or escaping, allowing an authenticated administrator to store arbitrary JavaScript that executes when any visitor loads a page rendering that field. This stored XSS can hijack user sessions, deface content, or redirect users to malicious sites.

All releases of bandido’s Morkva UA Shipping WordPress plugin up to and including version 1.7.9 are vulnerable. The flaw applies to multi‑site installations and only to sites where the unfiltered_html capability is disabled. WordPress sites that employ this plugin with administrator or higher privileges are at risk until the defect is patched.

The CVSS Base score of 4.4 indicates a low to moderate impact, and the EPSS score of less than 1 % suggests a very low probability of exploitation in the near term. The vulnerability is not listed in CISA’s KEV catalog. An attacker must be authenticated as an administrator or higher to inject the script, and the stored payload is subsequently executed for all visitors who view the affected page, enabling session hijacking, defacement, or redirection.