BOX NOW Delivery Croatia + Slovenia
BOX NOW Delivery Croatia + Slovenia has one disclosed vulnerability in the WordSec catalog, all reported in 2026; it is fixed as of September 2026. Their average CVSS score is 5.3, and the most serious one scores 5.3 out of 10.
The most common weakness is Missing Authorization, behind 1 of the records (100%).
The one issue recorded for BOX NOW Delivery Croatia + Slovenia has a vendor fix available, so running the current release closes it.
All of these findings were reported by Nabil Irawan. BOX NOW Delivery Croatia + Slovenia is installed on roughly 800 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 6.9.7.
CVE-2026-65504BOX NOW Delivery Croatia <= 3.3.0 - Missing Authorization
Read the full analysisVulnerability Records
BOX NOW Delivery Croatia + Slovenia
Author
ivanbebek
BOX NOW Delivery Croatia + Slovenia Delivery is used for connecting e-shops with parcel delivery services from BOX NOW. Third-Party Services This plugin uses the Boxnow service (https://boxnow.hr) to provide its functionality. Boxnow is a third-party service that allows users to send and receive parcels. Please note that by using this plugin, you agree to the terms of use and privacy policies of Boxnow. You can review these documents here: Boxnow Terms of Use Boxnow Privacy Policy Boxnow Frequently Asked Questions This plugin uses BOXNOW widget map (https://widget-v5.boxnow.hr/, https://widget-v5.boxnow.hr/popup.html) to provide locations for all the possible APMs.
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C