Multiparcels
Multiparcels Shipping FOR Woocommerce: vulnerabilities and CVEs
Multiparcels Shipping FOR Woocommerce has 8 published vulnerabilities, 2 of them in the last 12 months. 0 are rated critical and 0 are listed by CISA as actively exploited.
CVEs8
Last 12 months2
Critical0
Actively exploited0
All vulnerabilities in the catalogue →⭐ Follow this technology
Latest vulnerabilities
| CVE | Severity | EPSS | Active exploitation | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-66655 | High (7.1) | 0.25% | — | Aug 13, 2026 | Unauthenticated Cross Site Scripting (XSS) in MultiParcels Shipping For WooCommerce <= 1.30.36 versions. |
| CVE-2025-62995 | Medium (4.3) | 0.22% | — | Dec 9, 2025 | Missing Authorization vulnerability in multiparcels MultiParcels Shipping For WooCommerce multiparcels-shipping-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects… |
| CVE-2024-32095 | Medium (4.3) | 0.21% | — | Apr 15, 2024 | Cross-Site Request Forgery (CSRF) vulnerability in MultiParcels MultiParcels Shipping For WooCommerce.This issue affects MultiParcels Shipping For WooCommerce: from n/a before 1.16.9. |
| CVE-2023-3954 | Medium (6.1) | 0.46% | — | Aug 21, 2023 | The MultiParcels Shipping For WooCommerce WordPress plugin before 1.15.4 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used… |
| CVE-2023-3366 | Medium (4.3) | 0.27% | — | Aug 21, 2023 | The MultiParcels Shipping For WooCommerce WordPress plugin before 1.15.2 does not have CRSF check when deleting a shipment, allowing attackers to make any logged in user, delete arbitrary shipment via a CSRF attack |
| CVE-2023-3671 | Medium (6.1) | 0.46% | — | Aug 7, 2023 | The MultiParcels Shipping For WooCommerce WordPress plugin before 1.15.4 does not sanitise and escape various parameters before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be… |
| CVE-2023-3365 | High (8.1) | 0.74% | — | Aug 7, 2023 | The MultiParcels Shipping For WooCommerce WordPress plugin before 1.14.14 does not have authorisation when deleting shipment, allowing any authenticated users, such as subscriber to delete arbitrary shipment |
| CVE-2023-2843 | High (8.8) | 0.87% | — | Aug 7, 2023 | The MultiParcels Shipping For WooCommerce WordPress plugin before 1.14.15 does not properly sanitize and escape a parameter before using it in an SQL statement, which could allow any authenticated users, such as… |
🎯 How it gets exploited (ATT&CK techniques)
Number of CVEs of this technology mapped to each exploitation or primary-impact technique.