What is GHSA-rgq9-4m78-jwhm?

GHSA-rgq9-4m78-jwhm is a security advisory published by GitHub Security Advisories with High severity. The Dewa Kirim WordPress plugin through 1.0.0 does not escape delivery coordinates submitted at...

Which CVE IDs does GHSA-rgq9-4m78-jwhm cover?

GHSA-rgq9-4m78-jwhm covers the following CVE IDs: CVE-2026-87786. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-rgq9-4m78-jwhm?

GHSA-rgq9-4m78-jwhm has a CVSS v3 base score of 8.8, published by GitHub Security Advisories.

GHSA-rgq9-4m78-jwhmHighCVSS 8.8

The Dewa Kirim WordPress plugin through 1.0.0 does not escape delivery coordinates submitted at...

Vendor

GitHub Security Advisories

Published

September 17, 2026

Last Modified

September 17, 2026

🔗 CVE IDs covered (1)

CVE-2026-87786 →

📋 Description

The Dewa Kirim WordPress plugin through 1.0.0 does not escape delivery coordinates submitted at checkout before outputting them inside an inline script, allowing unauthenticated users to store JavaScript that runs in the session of an administrator who later opens the order.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-87786
https://wpscan.com/vulnerability/bb94cded-6ec1-488e-8682-555d276d2979
https://github.com/advisories/GHSA-rgq9-4m78-jwhm