Epeken All Kurir Vulnerabilities

The Epeken All Kurir for Woocommerce plugin for WordPress is vulnerable to Payment Bypass in all versions up to, and including, 2.1.2. This is due to a lack of server-side payment verification. This makes it possible for unauthenticated attackers to bypass payments.

CVSS:

5.3

Affected:

up to 2.1.2

Fix:

No patched version reported

Disclosed:

Aug 11, 2026

CVE-2026-16739 on NVD →

The Epeken All Kurir plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.0.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with shop manager-level access and above, to inject arbitrary web scripts in page...

CVSS:

5.5

Affected:

up to 2.0.2

Fix:

No patched version reported

Disclosed:

Sep 22, 2025

CVE-2025-57906 on NVD →

The Epeken All Kurir plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages...

CVSS:

6.4

Affected:

up to 2.0.1

Fixed in:

2.0.2

Disclosed:

Aug 27, 2025

CVE-2025-58212 on NVD →

The Epeken All Kurir Plugin for Woocommerce Full Version plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4.6.2. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to update settings and inject...

CVSS:

6.1

Affected:

up to 1.4.6.2

Fix:

No patched version reported

Disclosed:

Apr 9, 2025

CVE-2025-32673 on NVD →