Order Delivery Date For Woocommerce Vulnerabilities

The Order Delivery Date for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.6.0. This makes it possible for authenticated attackers, with Shop Manager-level access and above, to elevate their privileges to that of an administrator.

CVSS:

7.2

Affected:

up to 4.6.0

Fixed in:

4.6.1

Disclosed:

Aug 5, 2026

CVE-2026-65559 on NVD →

The Order Delivery Date for WooCommerce plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 4.5.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append add...

CVSS:

7.5

Affected:

up to 4.5.1

Fixed in:

4.5.2

Disclosed:

Apr 27, 2026

CVE-2026-42386 on NVD →

The Order Delivery Date for WooCommerce plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 4.3.1. This makes it possible for unauthenticated attackers to perform an unauthorized action.

CVSS:

5.3

Affected:

up to 4.3.1

Fixed in:

4.3.2

Disclosed:

Dec 3, 2025

CVE-2025-63024 on NVD →

The Order Delivery Date for WooCommerce plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 4.1.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to perform an unauthorized action.

CVSS:

4.3

Affected:

up to 4.1.0

Fixed in:

4.2.0

Disclosed:

Sep 3, 2025

CVE-2025-58599 on NVD →

The Order Delivery Date for WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.21.0. This is due to missing or incorrect nonce validation on the dismiss_notice() function. This makes it possible for unauthenticated attackers to dismiss notices via a forged r...

CVSS:

4.3

Affected:

up to 3.21.0

Fixed in:

3.21.1

Disclosed:

Apr 12, 2024

CVE-2024-32434 on NVD →

The Order Delivery Date for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'orddd_lite_custom_startdate' and 'orddd_lite_custom_enddate' parameters in versions up to, and including, 3.20.0 due to insufficient input sanitization and output escaping. This makes it possible for un...

CVSS:

6.1

Affected:

up to 3.20.0

Fixed in:

3.20.1

Disclosed:

Aug 2, 2023

CVE-2023-41874 on NVD →