Order Delivery Date Vulnerabilities

The Order Delivery Date Pro for WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in versions 2.0 to 12.6.0 (exclusive) via the orddd_order_calendar_content AJAX action. This makes it possible for unauthenticated attackers to extract post and page titles even when they are private or draf...

CVSS:

5.3

Affected:

2.0 – 12.6.0

Fixed in:

12.6.0

Disclosed:

Jun 20, 2025

CVE-2025-2942 on NVD →

The Order Delivery Date for WP e-Commerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'event_timeslot' parameter in all versions up to 12.4.0 (exclusive) due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary...

CVSS:

6.1

Affected:

up to 12.4.0

Fixed in:

12.4.0

Disclosed:

Apr 29, 2025

CVE-2025-2929 on NVD →

The Order Delivery Date for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the 'orddd-import-file' action in versions 2.0 to 12.3.1 (exclusive). This makes it possible for unauthenticated attackers to update...

CVSS:

9.8

Affected:

2.0 – 12.3.1

Fixed in:

12.3.1

Disclosed:

Apr 4, 2025

CVE-2025-2907 on NVD →

The Order Delivery Date for WP e-Commerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'available-days-tf' parameter in all versions up to, and including, 1.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary...

CVSS:

6.5

Affected:

up to 1.2

Fix:

No patched version reported

Disclosed:

Jan 29, 2024

CVE-2024-0678 on NVD →

The Order Delivery Date for WP e-Commerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions up to, and including, 1.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access and above,...

CVSS:

4.4

Affected:

up to 1.2

Fix:

No patched version reported

Disclosed:

Sep 5, 2023

CVE-2023-41859 on NVD →

The Order Delivery Date for WP e-Commerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.2. This is due to missing or incorrect nonce validation on the order_delivery_date_settings() function. This makes it possible for unauthenticated attackers to modify the plugin...

CVSS:

4.3

Affected:

up to 1.2

Fix:

No patched version reported

Disclosed:

Sep 5, 2023

CVE-2023-41858 on NVD →