Description
The GLS Shipping for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'failed_orders' parameter in all versions up to, and including, 1.4.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Published: 2026-05-14
Score: 6.1 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The GLS Shipping for WooCommerce plugin contains a reflected cross‑site scripting flaw that triggers when a user visits a page that includes the 'failed_orders' GET parameter. The parameter is not properly sanitized or escaped, so an unauthenticated attacker can inject arbitrary JavaScript payloads that run in the victim’s browser. This leads to the ability to steal session cookies, deface pages, or perform other client‑side attacks as described in CWE‑79.

Affected Systems

WordPress sites that have the GLS Shipping for WooCommerce plugin installed, specifically all versions up to and including 1.4.0. The plugin is maintained by the vendor bojansliskovicglscroatiacom.

Risk and Exploitability

The vulnerability scores a CVSS base of 6.1, indicating a medium severity. No EPSS value is published, and the flaw is not listed in CISA’s KEV catalog, so current exploitation likelihood is unclear. However, because the flaw is triggered by a simple crafted URL and does not require authentication, attackers can target any exposed instance of the plugin via a standard web browser. Users who have yet to patch should consider the risk moderate to high in the context of a web‑based business.

Generated by OpenCVE AI on May 14, 2026 at 07:30 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the GLS Shipping for WooCommerce plugin to a version newer than 1.4.0 that addresses the XSS flaw.
  • If an update is not immediately available, uninstall or disable the plugin to eliminate the attack surface.
  • Deploy a web application firewall or equivalent Web‑Application‑Level filtering that blocks suspicious input containing the 'failed_orders' parameter before it reaches the plugin.

Generated by OpenCVE AI on May 14, 2026 at 07:30 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 14 May 2026 15:00:00 +0000

Type Values Removed Values Added
First Time appeared Bojansliskovicglscroatiacom
Bojansliskovicglscroatiacom gls Shipping For Woocommerce
Wordpress
Wordpress wordpress
Vendors & Products Bojansliskovicglscroatiacom
Bojansliskovicglscroatiacom gls Shipping For Woocommerce
Wordpress
Wordpress wordpress

Thu, 14 May 2026 11:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 14 May 2026 06:00:00 +0000

Type Values Removed Values Added
Description The GLS Shipping for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'failed_orders' parameter in all versions up to, and including, 1.4.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Title GLS Shipping for WooCommerce <= 1.4.0 - Reflected Cross-Site Scripting via 'failed_orders'
Weaknesses CWE-79
References
Metrics cvssV3_1

{'score': 6.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'}

Subscriptions

Bojansliskovicglscroatiacom Gls Shipping For Woocommerce
Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: Wordfence

Published:

Updated: 2026-05-14T10:46:59.988Z

Reserved: 2026-04-16T00:14:46.246Z

Link: CVE-2026-6417

cve-icon Vulnrichment

Updated: 2026-05-14T10:46:54.933Z

cve-icon NVD

Status : Deferred

Published: 2026-05-14T06:16:24.927

Modified: 2026-05-14T14:28:41.283

Link: CVE-2026-6417

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-05-14T14:32:59Z

Weaknesses