CVE-2026-123124

*** Pendiente de traducción *** The WooCommerce Vindi Pagamento WordPress plugin through 0.8.3 does not perform any authorisation check when updating an order&amp;#39;s shipment tracking code, and does not escape that code when displaying it on the order edit page, allowing unauthenticated attackers to perform Stored Cross-Site Scripting attacks against administrators and shop managers who view an order paid through the gateway.<br /> The stored payload is only rendered on sites using WooCommerce&amp;#39;s legacy (WordPress posts) order storage.