Plugin Pengiriman WooCommerce Kurir Reguler, Instan, Kargo – Biteship

Plugin Pengiriman WooCommerce Kurir Reguler, Instan, Kargo – Biteship has 3 disclosed vulnerabilities in the WordSec catalog, reported between 2023 and 2025; 2 are fixed and 1 remains unpatched as of September 2026. Their average CVSS score is 5.3, and the most serious one scores 6.1 out of 10.

The most common weakness is Cross-Site Scripting, behind 2 of the records (67%). Other recurring categories include Missing Authorization.

2 of the records (67%) have a vendor fix, while 1 remain unpatched. The oldest unresolved one dates back to 2025.

3 independent researchers contributed these findings, one record each.

01234567891004.12.2023Today04.12.20235.5Biteship <= 2.2.27 - Authenticated (Shop manager+) Stored Cross-Site Scripting CVSS 5.5 · 04.12.202302.02.20246.1Biteship <= 2.2.24 - Reflected Cross-Site Scripting via biteship_error and biteship_message CVSS 6.1 · 02.02.202417.07.20254.3Plugin Pengiriman WooCommerce Kurir Reguler, Instan, Kargo – Biteship <= 3.2.0 - Insecure Direct Object Reference to Authenticated (Subscriber+) View Order Tracking Details CVSS 4.3 · 17.07.2025

Strategic Overview

Avg CVSSMedium
5.3/ 10
Patch Coverage67%
Open

1

Fixed

2

Get automatic notifications for all Plugin Pengiriman WooCommerce Kurir Reguler, Instan, Kargo – Biteship vulnerabilities before they are exploited.

Most severe open issueCVSS 4.3CVE-2025-5816

Plugin Pengiriman WooCommerce Kurir Reguler, Instan, Kargo – Biteship <= 3.2.0 - Insecure Direct Object Reference to Authenticated (Subscriber+) View Order Tracking Details

Read the full analysis

Vulnerability Records

3 records
Showing 1–3 of 3 reports

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C