Stored XSS in WordPress Checkout via Unescaped Coordinates

The Dewa Kirim WordPress plugin through 1.0.0 does not escape delivery coordinates submitted at checkout before outputting them inside an inline script, allowing unauthenticated users to store JavaScript that runs in the session of an administrator who later opens the order.

Casky was already ahead

This CVE exploits attack patterns that Casky's 323matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The Dewa Kirim WordPress plugin contains a stored cross-site scripting (XSS) vulnerability in its checkout functionality. When users submit delivery coordinates at checkout, the plugin fails to properly escape these inputs before embedding them directly into inline JavaScript within order pages. This allows attackers to inject malicious JavaScript payloads that persist in the database. When administrators later access affected orders, the payload executes in their browser with full administrative privileges. Any WordPress site running the vulnerable plugin through version 1.0.0 is at risk, particularly e-commerce deployments that rely on this shipping plugin. The attack requires no authentication, making it accessible to any threat actor.

Casky's 323 matching skills map this vulnerability across MITRE ATT&CK Initial Access (TA0001) and Persistence (TA0043) techniques, detecting the attack chain through Claude's extended reasoning. Practitioners using Casky would identify CWE-79 pattern matches indicating improper input sanitization in script contexts, cross-referencing against skill correlations for stored payload injection and session hijacking vectors. The platform's Claude-powered analysis would flag the specific attack pattern: untrusted user input flowing directly into inline script tags without HTML/JavaScript escaping. Security teams would see findings highlighting the privilege escalation path (unauthenticated attacker to admin context execution) and receive guidance on detecting similar injection patterns in checkout workflows, helping practitioners prioritize remediation and harden comparable input-handling routines across their WordPress infrastructure.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

323 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-87786.

Abuse of Public-Facing API: Mobile API Abuse

mobile security · low

Run

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

MITRE ATT&CK Techniques

TA0001 TA0043

Investigate the attack patterns behind CVE-2026-87786

Casky has 323 skills that investigate the attack patterns behind CVE-2026-87786. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn