CVE-2026-6417

Name of the Vulnerable Software and Affected Versions GLS Shipping for WooCommerce versions prior to 1.4.1

Description Reflected Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts into pages, which execute when a user is tricked into performing an action, such as clicking a link. The issue involves the failed orders parameter.

Recommendations Update to a version later than 1.4.0. As a temporary workaround, restrict access to or avoid using the failed orders parameter until the update is applied.