CVE-2026-39540 is a cross-site scripting vulnerability in the Shipment Tracker for Woocommerce plugin by Amit Mittal affecting versions <= 1.5.3.2. The issue arises from improper neutralization of input during web page generation, allowing subscriber-level users to inject malicious scripts that could be executed in the context of other users. The vulnerability has a CVSS 3.1 score of 6.5 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L), reflecting network attack vector, low attack complexity, requiring privileges of a subscriber, user interaction, and impacts on confidentiality, integrity, and availability with a scope change.

Successful exploitation could allow an attacker with subscriber privileges to execute arbitrary scripts in the context of other users, potentially leading to partial compromise of confidentiality, integrity, and availability of the affected system. This could result in unauthorized actions or data disclosure within the scope of the web application.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch is currently documented. Until a patch is available, limit subscriber privileges and monitor for suspicious activity related to this plugin.