Unknown Inpost Pl vulnerabilities

2 CVEs affecting Unknown Inpost Pl, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-93580, published 2026-09-30.

More from Unknown.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2026-9702, published 2026-06-25. High severity, CVSS 7.5. EPSS: 0.4% chance of exploitation in the next 30 days. The InPost PL WordPress plugin before 1.9.1 does not verify that the request originates from the legitimate buyer before allowing the WooCommerce order parcel-locker destination to be updated,…
• CVE-2026-93580, published 2026-09-30. Medium severity, CVSS 5.3. EPSS: 0.2% chance of exploitation in the next 30 days. The InPost PL WordPress plugin before 1.9.8 does not verify the authenticity of incoming shipment webhook requests, relying only on a non-secret identifier and an IP check that is not enforced,…