The Dewa Kirim WordPress plugin contains a high-severity stored cross-site scripting vulnerability that allows unauthenticated attackers to hijack administrator sessions.

This is a stored cross-site scripting (XSS) vulnerability caused by a failure to sanitize delivery coordinates at the checkout stage. An unauthenticated attacker can inject malicious JavaScript that executes within an administrator's browser session when they view the order details.

This vulnerability poses a significant risk to the integrity and confidentiality of the WordPress environment. Because the payload executes in the context of an administrator, an attacker could perform unauthorized administrative actions, modify site content, or gain further access to the underlying server infrastructure, justifying the high CVSS score of 8.8.

Immediate Action: There is currently no official patch available; administrators should immediately disable or uninstall the Dewa Kirim plugin until a secure update is released by the vendor.

Proactive Monitoring: Review administrative audit logs for unusual activity or unauthorized configuration changes that may indicate a compromised session.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common XSS patterns in POST requests directed at checkout endpoints.

Public Exploit Available: No confirmed public exploit exists in the provided data.

Given the ability for unauthenticated users to execute arbitrary code in an administrator session, the risk of site takeover is severe. Organizations must prioritize the removal of the vulnerable plugin immediately and monitor for any suspicious administrative actions that may have occurred prior to remediation.