Medium · 6.5 CVE-2026-66460 EUVD-2026-57879GHSA-vrxg-jj52-cf9v

WordPress AfterShip Tracking plugin <= 1.18.1 - Cross Site Scripting (XSS) vulnerability

Published Aug 13, 2026 · Updated Aug 13, 2026 · Assigned by Patchstack

Vendor: AfterShip & Automizely Product: AfterShip Tracking

Description

Subscriber Cross Site Scripting (XSS) in AfterShip Tracking <= 1.18.1 versions.

Affected products

Vendor	Product	Affected	Fixed
AfterShip & Automizely	AfterShip Tracking	≤ 1.18.1	—

References

https://patchstack.com/database/wordpress/plugin/aftership-woocommerce-tracking/vulnerability/wordpress-aftership-tracking-plugin-1-18-1-cross-site-scripting-xss-vulnerability?_s_id=cve vdb-entry