CodeRockz Delivery & Pickup Date Time for WooCommerce: Stored cross-site scripting
Summary
The WordPress plugin Delivery & Pickup Date Time for WooCommerce (woo-delivery) up to version 1.3.90 contains a stored cross-site scripting vulnerability (CWE-79). An attacker with low privileges, such as a subscriber account, can store malicious scripts that run in the browsers of other users, for example shop staff or customers, when they view the affected page. Exploitation requires a privileged user to perform an action, such as clicking a link or submitting a form.
Affected
- CodeRockz Delivery & Pickup Date Time for WooCommerce (woo-delivery) from n/a through 1.3.90
- Lowest affected version: Unknown.
- PRO version: Unknown.
Fixed in
- Reported fixed in 1.3.91 (unverified, not confirmed by Patchstack or the vendor; the WordPress.org listing showed 1.3.90 as current at the time of research).
Workaround
- No vendor-published workaround.
- Until a fixed version is confirmed, restrict accounts that can write data displayed on checkout and order pages.
- Review recent changes to delivery and pickup fields and order notes for script-like content.
- Use a web application firewall rule if available, or disable the plugin if the business can operate without it.
- Check that a Content Security Policy is in use to limit the impact of injected scripts.
Exploitation
- No evidence of exploitation in the wild found; not listed in KEV at the time of research.
- No public proof of concept confirmed; VulDB states an exploit is not publicly available. Unconfirmed, recheck in a few days.
- Patchstack rates the priority as medium and expects exploitation.
Our recommendation
- Update the plugin to the fixed version as soon as Patchstack or CodeRockz confirms it (1.3.91 is reported but unverified).
- Review shop accounts with write access and check delivery fields and order notes for injected script content.
- Check whether the plugin is installed on public shop sites and whether PRO versions are in use.
- Monitor for newly published exploit details and recheck the KEV status in the coming days.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Patchstack vulnerability record patchstack.com
- VulDB CVE-2026-124256 vuldb.com
- Strix CVE-2026-124256 (NVD-derived data) www.strix.ai
- CVE Threat Intelligence record cve.threatint.com
- OffSeq threat radar (machine-generated) radar.offseq.com
- WordPress.org plugin listing woo-delivery wordpress.org
- CodeRockz vendor website coderockz.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 11:51.
Original description (NVD)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CodeRockz Delivery & Pickup Date Time for WooCommerce woo-delivery allows Stored XSS.This issue affects Delivery & Pickup Date Time for WooCommerce: from n/a through 1.3.90.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.