Does Morkva UA Shipping have any unpatched vulnerabilities?

No. All known vulnerabilities in Morkva UA Shipping have been patched as of the latest data update. Always keep the plugin updated to the latest version.

Is Morkva UA Shipping compatible with WordPress 6.9.4?

According to WordPress.org data, Morkva UA Shipping 1.8.3 has been tested up to WordPress 6.9.4. Check the plugin's changelog for the latest compatibility information.

Is Morkva UA Shipping compatible with PHP 7.4+?

Morkva UA Shipping requires PHP 7.4 or higher. Most modern WordPress hosts run PHP 8.1 or 8.2. If you are on an older PHP version, consider upgrading before installing this plugin.

How often is Morkva UA Shipping updated?

Morkva UA Shipping was last updated on Mar 5, 2026. Frequent updates are generally a positive security signal.

What is Morkva UA Shipping's security score?

Morkva UA Shipping has a WP-Safety security score of 93/100. This score is computed from CVE history, patch response time, developer trust signals, and plugin maintenance activity.

Morkva UA Shipping Security & Risk Analysis

wordpress.org/plugins/morkva-ua-shipping

Нова Пошта по Україні та закордон, Укрпошта по Україні та закордон. Rozetka Delivery. Зручне створення ТТН. Друк ТТН. Сумісний з іншими плагінами.

800 active installs v1.8.3 PHP 7.4+ WP 5.0+ Updated Mar 5, 2026

%d0%bd%d0%be%d0%b2%d0%b0-%d0%bf%d0%be%d1%88%d1%82%d0%b0nova-poshta%d1%83%d0%ba%d1%80%d0%bf%d0%be%d1%88%d1%82%d0%b0

A · Safe

CVEs total2

Unpatched0

Last CVEMar 3, 2026

Plugin page Download

Safety Verdict

Is Morkva UA Shipping Safe to Use in 2026?

Generally Safe

Score 93/100

Morkva UA Shipping has a strong security track record. Known vulnerabilities have been patched promptly.

2 known CVEsLast CVE: Mar 3, 2026Updated 29d ago

Risk Assessment

The "morkva-ua-shipping" plugin v1.8.4 exhibits a mixed security posture. While it has a relatively low number of entry points compared to its static analysis findings, a significant concern arises from one unprotected REST API route, which is a direct avenue for potential unauthorized access or manipulation. The presence of 5 SQL queries, none of which utilize prepared statements, is a considerable risk for SQL injection vulnerabilities. Furthermore, with 59% of outputs properly escaped, there's a substantial chance for Cross-Site Scripting (XSS) vulnerabilities to exist, especially when combined with the historical vulnerability data.

Key Concerns

REST API route without permission callback
SQL queries not using prepared statements
Insufficient output escaping
High number of flows with unsanitized paths
Bundled Select2 library

Vulnerabilities

Morkva UA Shipping Security Vulnerabilities

CVEs by Year

1 CVE in 2025

2025

1 CVE in 2026

2026

Patched Has unpatched

Severity Breakdown

Critical

Medium

2 total CVEs

CVE-2026-2292medium · 4.4Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Morkva UA Shipping <= 1.7.9 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Weight, kg' Field

Mar 3, 2026 Patched in 1.7.10 (1d)

CVE-2025-24685critical · 9.8Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')

Morkva UA Shipping <= 1.0.18 - Unauthenticated Local File Inclusion

Jan 27, 2025 Patched in 1.0.20 (8d)

Code Analysis

Analyzed Mar 16, 2026

Morkva UA Shipping Code Analysis

Dangerous Functions

Raw SQL Queries

0 prepared

Unescaped Output

478

699 escaped

Nonce Checks

Capability Checks

File Operations

External Requests

Bundled Libraries

Select2

SQL Query Safety

0% prepared5 total queries

Output Escaping

59% escaped1177 total outputs

Data Flows

9 unsanitized

Data Flow Analysis

14 flows9 with unsanitized paths

get_rozetka_city (classes\shipping_methods\rozetka-delivery\ajax\mrkv-ua-shipping-methods-ajax-rozetka.php:25)

Source (user input) Sink (dangerous op) Sanitizer Transform Unsanitized Sanitized

Attack Surface

1 unprotected

Morkva UA Shipping Attack Surface

Entry Points49

Unprotected1

AJAX Handlers 48

authwp_ajax_mrkv_ua_ship_clear_logclasses\shipping_methods\mrkv-ua-shipping-methods-ajax.php:36

noprivwp_ajax_mrkv_ua_ship_clear_logclasses\shipping_methods\mrkv-ua-shipping-methods-ajax.php:37

authwp_ajax_mrkv_ua_ship_get_order_dataclasses\shipping_methods\mrkv-ua-shipping-methods-ajax.php:39

noprivwp_ajax_mrkv_ua_ship_get_order_dataclasses\shipping_methods\mrkv-ua-shipping-methods-ajax.php:40

authwp_ajax_mrkv_ua_ship_create_invoiceclasses\shipping_methods\mrkv-ua-shipping-methods-ajax.php:42

noprivwp_ajax_mrkv_ua_ship_create_invoiceclasses\shipping_methods\mrkv-ua-shipping-methods-ajax.php:43

authwp_ajax_mrkv_ua_ship_update_order_dataclasses\shipping_methods\mrkv-ua-shipping-methods-ajax.php:45

noprivwp_ajax_mrkv_ua_ship_update_order_dataclasses\shipping_methods\mrkv-ua-shipping-methods-ajax.php:46

authwp_ajax_mrkv_ua_ship_update_invoice_dataclasses\shipping_methods\mrkv-ua-shipping-methods-ajax.php:48

noprivwp_ajax_mrkv_ua_ship_update_invoice_dataclasses\shipping_methods\mrkv-ua-shipping-methods-ajax.php:49

authwp_ajax_mrkv_ua_ship_remove_invoice_dataclasses\shipping_methods\mrkv-ua-shipping-methods-ajax.php:51

noprivwp_ajax_mrkv_ua_ship_remove_invoice_dataclasses\shipping_methods\mrkv-ua-shipping-methods-ajax.php:52

authwp_ajax_mrkv_ua_ship_remove_all_invoicesclasses\shipping_methods\mrkv-ua-shipping-methods-ajax.php:54

noprivwp_ajax_mrkv_ua_ship_remove_all_invoicesclasses\shipping_methods\mrkv-ua-shipping-methods-ajax.php:55

authwp_ajax_mrkv_update_shipping_methodclasses\shipping_methods\mrkv-ua-shipping-methods-ajax.php:57

noprivwp_ajax_mrkv_update_shipping_methodclasses\shipping_methods\mrkv-ua-shipping-methods-ajax.php:58

authwp_ajax_mrkv_ua_ship_nova_global_warehouseclasses\shipping_methods\nova-global\ajax\mrkv-ua-shipping-methods-ajax-nova-global.php:18

noprivwp_ajax_mrkv_ua_ship_nova_global_warehouseclasses\shipping_methods\nova-global\ajax\mrkv-ua-shipping-methods-ajax-nova-global.php:19

authwp_ajax_mrkv_ua_ship_nova_poshta_areaclasses\shipping_methods\nova-poshta\ajax\mrkv-ua-shipping-methods-ajax-nova.php:18

noprivwp_ajax_mrkv_ua_ship_nova_poshta_areaclasses\shipping_methods\nova-poshta\ajax\mrkv-ua-shipping-methods-ajax-nova.php:19

authwp_ajax_mrkv_ua_ship_nova_poshta_cityclasses\shipping_methods\nova-poshta\ajax\mrkv-ua-shipping-methods-ajax-nova.php:21

noprivwp_ajax_mrkv_ua_ship_nova_poshta_cityclasses\shipping_methods\nova-poshta\ajax\mrkv-ua-shipping-methods-ajax-nova.php:22

authwp_ajax_mrkv_ua_ship_nova_poshta_warehouseclasses\shipping_methods\nova-poshta\ajax\mrkv-ua-shipping-methods-ajax-nova.php:24

noprivwp_ajax_mrkv_ua_ship_nova_poshta_warehouseclasses\shipping_methods\nova-poshta\ajax\mrkv-ua-shipping-methods-ajax-nova.php:25

authwp_ajax_mrkv_ua_ship_nova_poshta_streetclasses\shipping_methods\nova-poshta\ajax\mrkv-ua-shipping-methods-ajax-nova.php:27

noprivwp_ajax_mrkv_ua_ship_nova_poshta_streetclasses\shipping_methods\nova-poshta\ajax\mrkv-ua-shipping-methods-ajax-nova.php:28

authwp_ajax_mrkv_ua_ship_nova_poshta_street_defaultclasses\shipping_methods\nova-poshta\ajax\mrkv-ua-shipping-methods-ajax-nova.php:30

noprivwp_ajax_mrkv_ua_ship_nova_poshta_street_defaultclasses\shipping_methods\nova-poshta\ajax\mrkv-ua-shipping-methods-ajax-nova.php:31

authwp_ajax_mrkv_ua_ship_nova_poshta_sender_get_address_refclasses\shipping_methods\nova-poshta\ajax\mrkv-ua-shipping-methods-ajax-nova.php:33

noprivwp_ajax_mrkv_ua_ship_nova_poshta_sender_get_address_refclasses\shipping_methods\nova-poshta\ajax\mrkv-ua-shipping-methods-ajax-nova.php:34

authwp_ajax_mrkv_ua_ship_novapost_divisionsclasses\shipping_methods\nova-poshta\ajax\mrkv-ua-shipping-methods-ajax-nova.php:36

noprivwp_ajax_mrkv_ua_ship_novapost_divisionsclasses\shipping_methods\nova-poshta\ajax\mrkv-ua-shipping-methods-ajax-nova.php:37

authwp_ajax_mrkv_ua_ship_rozetka_delivery_cityclasses\shipping_methods\rozetka-delivery\ajax\mrkv-ua-shipping-methods-ajax-rozetka.php:18

noprivwp_ajax_mrkv_ua_ship_rozetka_delivery_cityclasses\shipping_methods\rozetka-delivery\ajax\mrkv-ua-shipping-methods-ajax-rozetka.php:19

authwp_ajax_mrkv_ua_ship_rozetka_delivery_warehouseclasses\shipping_methods\rozetka-delivery\ajax\mrkv-ua-shipping-methods-ajax-rozetka.php:21

noprivwp_ajax_mrkv_ua_ship_rozetka_delivery_warehouseclasses\shipping_methods\rozetka-delivery\ajax\mrkv-ua-shipping-methods-ajax-rozetka.php:22

authwp_ajax_mrkv_ua_ship_ukr_poshta_cityclasses\shipping_methods\ukr-poshta\ajax\mrkv-ua-shipping-methods-ajax-ukr.php:18

noprivwp_ajax_mrkv_ua_ship_ukr_poshta_cityclasses\shipping_methods\ukr-poshta\ajax\mrkv-ua-shipping-methods-ajax-ukr.php:19

authwp_ajax_mrkv_ua_ship_ukr_poshta_warehouseclasses\shipping_methods\ukr-poshta\ajax\mrkv-ua-shipping-methods-ajax-ukr.php:21

noprivwp_ajax_mrkv_ua_ship_ukr_poshta_warehouseclasses\shipping_methods\ukr-poshta\ajax\mrkv-ua-shipping-methods-ajax-ukr.php:22

authwp_ajax_mrkv_ua_ship_ukr_poshta_streetclasses\shipping_methods\ukr-poshta\ajax\mrkv-ua-shipping-methods-ajax-ukr.php:24

noprivwp_ajax_mrkv_ua_ship_ukr_poshta_streetclasses\shipping_methods\ukr-poshta\ajax\mrkv-ua-shipping-methods-ajax-ukr.php:25

authwp_ajax_mrkv_ua_ship_ukr_poshta_houseclasses\shipping_methods\ukr-poshta\ajax\mrkv-ua-shipping-methods-ajax-ukr.php:27

noprivwp_ajax_mrkv_ua_ship_ukr_poshta_houseclasses\shipping_methods\ukr-poshta\ajax\mrkv-ua-shipping-methods-ajax-ukr.php:28

authwp_ajax_mrkv_ua_ship_ukr_poshta_warehouse_idclasses\shipping_methods\ukr-poshta\ajax\mrkv-ua-shipping-methods-ajax-ukr.php:30

noprivwp_ajax_mrkv_ua_ship_ukr_poshta_warehouse_idclasses\shipping_methods\ukr-poshta\ajax\mrkv-ua-shipping-methods-ajax-ukr.php:31

authwp_ajax_mrkv_ua_ship_ukr_poshta_address_idclasses\shipping_methods\ukr-poshta\ajax\mrkv-ua-shipping-methods-ajax-ukr.php:33

noprivwp_ajax_mrkv_ua_ship_ukr_poshta_address_idclasses\shipping_methods\ukr-poshta\ajax\mrkv-ua-shipping-methods-ajax-ukr.php:34

REST API Routes 1

GET/wp-json/mrkv_ua_shipping/v1/check_ttnclasses\shipping_methods\mrkv-ua-shipping-methods-cron.php:27

WordPress Hooks 35

actionadmin_enqueue_scriptsclasses\settings\admin\mrkv-ua-shipping-admin-assets.php:19

actionadmin_menuclasses\settings\admin\mrkv-ua-shipping-menu.php:25

actionadmin_initclasses\settings\admin\mrkv-ua-shipping-notification.php:18

actionadmin_noticesclasses\settings\admin\mrkv-ua-shipping-notification.php:19

actionadmin_initclasses\settings\global\mrkv-ua-shipping-options.php:19

actionwoocommerce_order_status_changedclasses\shipping_methods\mrkv-ua-shipping-methods-autocreate.php:19

actionwoocommerce_checkout_order_processedclasses\shipping_methods\mrkv-ua-shipping-methods-autocreate.php:22

actionwoocommerce_checkout_processclasses\shipping_methods\mrkv-ua-shipping-methods-checkout-validation.php:43

filterwoocommerce_checkout_fieldsclasses\shipping_methods\mrkv-ua-shipping-methods-checkout-validation.php:44

actionwoocommerce_before_checkout_formclasses\shipping_methods\mrkv-ua-shipping-methods-checkout.php:26

filterwoocommerce_cart_shipping_packagesclasses\shipping_methods\mrkv-ua-shipping-methods-checkout.php:27

filterwoocommerce_checkout_fieldsclasses\shipping_methods\mrkv-ua-shipping-methods-checkout.php:28

actionwp_loadedclasses\shipping_methods\mrkv-ua-shipping-methods-cron.php:19

actionmrknp_ua_shipping_nova_poshta_statusesclasses\shipping_methods\mrkv-ua-shipping-methods-cron.php:20

actionrest_api_initclasses\shipping_methods\mrkv-ua-shipping-methods-cron.php:22

actionwoocommerce_checkout_create_orderclasses\shipping_methods\mrkv-ua-shipping-methods-order.php:18

actionwp_loadedclasses\shipping_methods\mrkv-ua-shipping-methods.php:31

actionadd_meta_boxesclasses\woocommerce\mrkv-ua-shipping-woo-order.php:21

actionwoocommerce_admin_order_data_after_billing_addressclasses\woocommerce\mrkv-ua-shipping-woo-order.php:23

actionwoocommerce_admin_order_data_after_shipping_addressclasses\woocommerce\mrkv-ua-shipping-woo-order.php:24

actionwoocommerce_process_shop_order_metaclasses\woocommerce\mrkv-ua-shipping-woo-order.php:25

filtermanage_woocommerce_page_wc-orders_columnsclasses\woocommerce\mrkv-ua-shipping-woo-orders.php:22

actionmanage_woocommerce_page_wc-orders_custom_columnclasses\woocommerce\mrkv-ua-shipping-woo-orders.php:23

filtermanage_edit-shop_order_columnsclasses\woocommerce\mrkv-ua-shipping-woo-orders.php:26

actionmanage_shop_order_posts_custom_columnclasses\woocommerce\mrkv-ua-shipping-woo-orders.php:27

actionadmin_footerclasses\woocommerce\mrkv-ua-shipping-woo-orders.php:30

filterwoocommerce_account_orders_columnsclasses\woocommerce\mrkv-ua-shipping-woo-orders.php:32

actionwoocommerce_my_account_my_orders_column_mrkv_ua_ship_ttn-columnclasses\woocommerce\mrkv-ua-shipping-woo-orders.php:33

filterwoocommerce_product_data_tabsclasses\woocommerce\mrkv-ua-shipping-woo-product.php:21

actionwoocommerce_product_data_panelsclasses\woocommerce\mrkv-ua-shipping-woo-product.php:22

actionwoocommerce_process_product_metaclasses\woocommerce\mrkv-ua-shipping-woo-product.php:23

actionbefore_woocommerce_initmrkv-ua-shipping.php:20

actioninitmrkv-ua-shipping.php:49

actionwoocommerce_shipping_initmrkv-ua-shipping.php:52

filterwoocommerce_shipping_methodsmrkv-ua-shipping.php:78

Maintenance & Trust

Morkva UA Shipping Maintenance & Trust

Maintenance Signals

WordPress version tested6.9.4

Last updatedMar 5, 2026

PHP min version7.4

Downloads16K

Community Trust

Rating98/100

Number of ratings22

Active installs800

Alternatives

Morkva UA Shipping Alternatives

WC Ukraine Shipping – Integration of Nova Poshta and Ukrposhta for WooCommerce

wc-ukr-shipping

100

Connect Nova Poshta, Ukrposhta, Meest or international delivery services with your store. Create labels, track orders and calculate rates in one place …

7K No CVEs

Shipping for Nova Poshta

nova-poshta-ttn

Доставка на відділення, поштомат та адресу (з автопошуком вулиць). Створення ТТН. Найзручніший плагін.

500 1 CVE

Ukrposhta

woo-ukrposhta

Створюйте експрес-накладні автоматично, на сторінці замовлення. 10% знижка на відправлення, створені онлайн за допомогою API Ukrposhta.

600 1 CVE

Woo NovaPoshta. Электронная накладная

nova-poshta-declarations

Новая почта электронные накладные. Вывод электронных накладных в заказе (woocommerce).

10 No CVEs

Shipping of Nova Poshta for WooCommerce

wc-nova-poshta-for-shop

100

Підключення служби доставки Нова Пошта до Вашого сайту (WooCommerce)

10 No CVEs

Developer Profile

Morkva UA Shipping Developer Profile

Ihor Kit

14 plugins · 3K total installs

trust score

Avg Security Score

98/100

Avg Patch Time

11 days

View full developer profile

Detection Fingerprints

How We Detect Morkva UA Shipping

Patterns used to identify this plugin on WordPress sites during automated security audits and web crawling.

Asset Fingerprints

Asset Paths

/wp-content/plugins/morkva-ua-shipping/assets/css/global/global-mrkv-ua-shipping.css/wp-content/plugins/morkva-ua-shipping/assets/js/global/select2.min.js/wp-content/plugins/morkva-ua-shipping/assets/js/global/global-mrkv-ua-shipping.js/wp-content/plugins/morkva-ua-shipping/assets/js/global/global-mrkv-ua-shipping-nova-poshta.js/wp-content/plugins/morkva-ua-shipping/assets/js/global/global-mrkv-ua-shipping-ukrposhta.js/wp-content/plugins/morkva-ua-shipping/assets/css/nova-poshta/nova-poshta-mrkv-ua-shipping.css/wp-content/plugins/morkva-ua-shipping/assets/js/nova-poshta/nova-poshta-mrkv-ua-shipping.js/wp-content/plugins/morkva-ua-shipping/assets/css/ukrposhta/ukrposhta-mrkv-ua-shipping.css+1 more

Script Paths

/wp-content/plugins/morkva-ua-shipping/assets/js/global/select2.min.js/wp-content/plugins/morkva-ua-shipping/assets/js/global/global-mrkv-ua-shipping.js/wp-content/plugins/morkva-ua-shipping/assets/js/global/global-mrkv-ua-shipping-nova-poshta.js/wp-content/plugins/morkva-ua-shipping/assets/js/global/global-mrkv-ua-shipping-ukrposhta.js/wp-content/plugins/morkva-ua-shipping/assets/js/nova-poshta/nova-poshta-mrkv-ua-shipping.js/wp-content/plugins/morkva-ua-shipping/assets/js/ukrposhta/ukrposhta-mrkv-ua-shipping.js

Version Parameters

morkva-ua-shipping/assets/css/global/global-mrkv-ua-shipping.css?ver=morkva-ua-shipping/assets/js/global/select2.min.js?ver=morkva-ua-shipping/assets/js/global/global-mrkv-ua-shipping.js?ver=morkva-ua-shipping/assets/js/global/global-mrkv-ua-shipping-nova-poshta.js?ver=morkva-ua-shipping/assets/js/global/global-mrkv-ua-shipping-ukrposhta.js?ver=morkva-ua-shipping/assets/css/nova-poshta/nova-poshta-mrkv-ua-shipping.css?ver=morkva-ua-shipping/assets/js/nova-poshta/nova-poshta-mrkv-ua-shipping.js?ver=morkva-ua-shipping/assets/css/ukrposhta/ukrposhta-mrkv-ua-shipping.css?ver=morkva-ua-shipping/assets/js/ukrposhta/ukrposhta-mrkv-ua-shipping.js?ver=

HTML / DOM Fingerprints

CSS Classes

mrkv-ua-shipping-admin-settingsmrkv-ua-shipping-order-details

Data Attributes

data-nonce-field

JS Globals

mrkv_ua_ship_helperMRKV_UA_SHIPPING_PLUGIN_VERSION

FAQ