WP-Safety

Morkva UA Shipping Security & Risk Analysis

wordpress.org/plugins/morkva-ua-shipping

Нова Пошта по Україні та закордон, Укрпошта по Україні та закордон. Rozetka Delivery. Зручне створення ТТН. Друк ТТН. Сумісний з іншими плагінами.

900 active installs v1.8.8 PHP 7.4+ WP 5.0+ Updated Apr 14, 2026
%d0%bd%d0%be%d0%b2%d0%b0-%d0%bf%d0%be%d1%88%d1%82%d0%b0nova-poshta%d1%83%d0%ba%d1%80%d0%bf%d0%be%d1%88%d1%82%d0%b0
93
A · Safe
CVEs total2
Unpatched0
Last CVEMar 3, 2026
Plugin page Download
Safety Verdict

Is Morkva UA Shipping Safe to Use in 2026?

Generally Safe

Score 93/100

Morkva UA Shipping has a strong security track record. Known vulnerabilities have been patched promptly. It's a solid choice for most WordPress installations.

2 known CVEsLast CVE: Mar 3, 2026Updated 1mo ago
Risk Assessment

The "morkva-ua-shipping" plugin v1.8.4 exhibits a mixed security posture. While it has a relatively low number of entry points compared to its static analysis findings, a significant concern arises from one unprotected REST API route, which is a direct avenue for potential unauthorized access or manipulation. The presence of 5 SQL queries, none of which utilize prepared statements, is a considerable risk for SQL injection vulnerabilities. Furthermore, with 59% of outputs properly escaped, there's a substantial chance for Cross-Site Scripting (XSS) vulnerabilities to exist, especially when combined with the historical vulnerability data.

Key Concerns

  • REST API route without permission callback
  • SQL queries not using prepared statements
  • Insufficient output escaping
  • High number of flows with unsanitized paths
  • Bundled Select2 library
Vulnerabilities
2 published

Morkva UA Shipping Security Vulnerabilities

CVEs by Year

1 CVE in 2025
2025
1 CVE in 2026
2026
Patched Has unpatched

Severity Breakdown

Critical
1
Medium
1

2 total CVEs

CVE-2026-2292medium · 4.4Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Morkva UA Shipping <= 1.7.9 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Weight, kg' Field

Mar 3, 2026 Patched in 1.7.10 (1d)
CVE-2025-24685critical · 9.8Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')

Morkva UA Shipping <= 1.0.18 - Unauthenticated Local File Inclusion

Jan 27, 2025 Patched in 1.0.20 (8d)
Version History

Morkva UA Shipping Release Timeline

v1.8.8Current
v1.8.7
v1.8.6
v1.8.5
v1.8.4
v1.8.3
v1.8.2
v1.8.1
v1.8.0
v1.7.10
v1.7.91 CVE
CVE-2026-2292
v1.7.81 CVE
CVE-2026-2292
v1.7.71 CVE
CVE-2026-2292
v1.7.61 CVE
CVE-2026-2292
v1.7.51 CVE
CVE-2026-2292
v1.7.41 CVE
CVE-2026-2292
v1.7.31 CVE
CVE-2026-2292
v1.7.21 CVE
CVE-2026-2292
v1.7.11 CVE
CVE-2026-2292
v1.7.01 CVE
CVE-2026-2292
Code Analysis
Analyzed Mar 16, 2026

Morkva UA Shipping Code Analysis

Dangerous Functions
0
Raw SQL Queries
5
0 prepared
Unescaped Output
478
699 escaped
Nonce Checks
25
Capability Checks
4
File Operations
18
External Requests
16
Bundled Libraries
1

Bundled Libraries

Select2

SQL Query Safety

0% prepared5 total queries

Output Escaping

59% escaped1177 total outputs
Data Flows · Security
9 unsanitized

Data Flow Analysis

14 flows9 with unsanitized paths
get_rozetka_city (classes\shipping_methods\rozetka-delivery\ajax\mrkv-ua-shipping-methods-ajax-rozetka.php:25)
Source (user input) Sink (dangerous op) Sanitizer Transform Unsanitized Sanitized
Attack Surface
1 unprotected

Morkva UA Shipping Attack Surface

Entry Points49
Unprotected1

AJAX Handlers 48

authwp_ajax_mrkv_ua_ship_clear_logclasses\shipping_methods\mrkv-ua-shipping-methods-ajax.php:36
noprivwp_ajax_mrkv_ua_ship_clear_logclasses\shipping_methods\mrkv-ua-shipping-methods-ajax.php:37
authwp_ajax_mrkv_ua_ship_get_order_dataclasses\shipping_methods\mrkv-ua-shipping-methods-ajax.php:39
noprivwp_ajax_mrkv_ua_ship_get_order_dataclasses\shipping_methods\mrkv-ua-shipping-methods-ajax.php:40
authwp_ajax_mrkv_ua_ship_create_invoiceclasses\shipping_methods\mrkv-ua-shipping-methods-ajax.php:42
noprivwp_ajax_mrkv_ua_ship_create_invoiceclasses\shipping_methods\mrkv-ua-shipping-methods-ajax.php:43
authwp_ajax_mrkv_ua_ship_update_order_dataclasses\shipping_methods\mrkv-ua-shipping-methods-ajax.php:45
noprivwp_ajax_mrkv_ua_ship_update_order_dataclasses\shipping_methods\mrkv-ua-shipping-methods-ajax.php:46
authwp_ajax_mrkv_ua_ship_update_invoice_dataclasses\shipping_methods\mrkv-ua-shipping-methods-ajax.php:48
noprivwp_ajax_mrkv_ua_ship_update_invoice_dataclasses\shipping_methods\mrkv-ua-shipping-methods-ajax.php:49
authwp_ajax_mrkv_ua_ship_remove_invoice_dataclasses\shipping_methods\mrkv-ua-shipping-methods-ajax.php:51
noprivwp_ajax_mrkv_ua_ship_remove_invoice_dataclasses\shipping_methods\mrkv-ua-shipping-methods-ajax.php:52
authwp_ajax_mrkv_ua_ship_remove_all_invoicesclasses\shipping_methods\mrkv-ua-shipping-methods-ajax.php:54
noprivwp_ajax_mrkv_ua_ship_remove_all_invoicesclasses\shipping_methods\mrkv-ua-shipping-methods-ajax.php:55
authwp_ajax_mrkv_update_shipping_methodclasses\shipping_methods\mrkv-ua-shipping-methods-ajax.php:57
noprivwp_ajax_mrkv_update_shipping_methodclasses\shipping_methods\mrkv-ua-shipping-methods-ajax.php:58
authwp_ajax_mrkv_ua_ship_nova_global_warehouseclasses\shipping_methods\nova-global\ajax\mrkv-ua-shipping-methods-ajax-nova-global.php:18
noprivwp_ajax_mrkv_ua_ship_nova_global_warehouseclasses\shipping_methods\nova-global\ajax\mrkv-ua-shipping-methods-ajax-nova-global.php:19
authwp_ajax_mrkv_ua_ship_nova_poshta_areaclasses\shipping_methods\nova-poshta\ajax\mrkv-ua-shipping-methods-ajax-nova.php:18
noprivwp_ajax_mrkv_ua_ship_nova_poshta_areaclasses\shipping_methods\nova-poshta\ajax\mrkv-ua-shipping-methods-ajax-nova.php:19
authwp_ajax_mrkv_ua_ship_nova_poshta_cityclasses\shipping_methods\nova-poshta\ajax\mrkv-ua-shipping-methods-ajax-nova.php:21
noprivwp_ajax_mrkv_ua_ship_nova_poshta_cityclasses\shipping_methods\nova-poshta\ajax\mrkv-ua-shipping-methods-ajax-nova.php:22
authwp_ajax_mrkv_ua_ship_nova_poshta_warehouseclasses\shipping_methods\nova-poshta\ajax\mrkv-ua-shipping-methods-ajax-nova.php:24
noprivwp_ajax_mrkv_ua_ship_nova_poshta_warehouseclasses\shipping_methods\nova-poshta\ajax\mrkv-ua-shipping-methods-ajax-nova.php:25
authwp_ajax_mrkv_ua_ship_nova_poshta_streetclasses\shipping_methods\nova-poshta\ajax\mrkv-ua-shipping-methods-ajax-nova.php:27
noprivwp_ajax_mrkv_ua_ship_nova_poshta_streetclasses\shipping_methods\nova-poshta\ajax\mrkv-ua-shipping-methods-ajax-nova.php:28
authwp_ajax_mrkv_ua_ship_nova_poshta_street_defaultclasses\shipping_methods\nova-poshta\ajax\mrkv-ua-shipping-methods-ajax-nova.php:30
noprivwp_ajax_mrkv_ua_ship_nova_poshta_street_defaultclasses\shipping_methods\nova-poshta\ajax\mrkv-ua-shipping-methods-ajax-nova.php:31
authwp_ajax_mrkv_ua_ship_nova_poshta_sender_get_address_refclasses\shipping_methods\nova-poshta\ajax\mrkv-ua-shipping-methods-ajax-nova.php:33
noprivwp_ajax_mrkv_ua_ship_nova_poshta_sender_get_address_refclasses\shipping_methods\nova-poshta\ajax\mrkv-ua-shipping-methods-ajax-nova.php:34
authwp_ajax_mrkv_ua_ship_novapost_divisionsclasses\shipping_methods\nova-poshta\ajax\mrkv-ua-shipping-methods-ajax-nova.php:36
noprivwp_ajax_mrkv_ua_ship_novapost_divisionsclasses\shipping_methods\nova-poshta\ajax\mrkv-ua-shipping-methods-ajax-nova.php:37
authwp_ajax_mrkv_ua_ship_rozetka_delivery_cityclasses\shipping_methods\rozetka-delivery\ajax\mrkv-ua-shipping-methods-ajax-rozetka.php:18
noprivwp_ajax_mrkv_ua_ship_rozetka_delivery_cityclasses\shipping_methods\rozetka-delivery\ajax\mrkv-ua-shipping-methods-ajax-rozetka.php:19
authwp_ajax_mrkv_ua_ship_rozetka_delivery_warehouseclasses\shipping_methods\rozetka-delivery\ajax\mrkv-ua-shipping-methods-ajax-rozetka.php:21
noprivwp_ajax_mrkv_ua_ship_rozetka_delivery_warehouseclasses\shipping_methods\rozetka-delivery\ajax\mrkv-ua-shipping-methods-ajax-rozetka.php:22
authwp_ajax_mrkv_ua_ship_ukr_poshta_cityclasses\shipping_methods\ukr-poshta\ajax\mrkv-ua-shipping-methods-ajax-ukr.php:18
noprivwp_ajax_mrkv_ua_ship_ukr_poshta_cityclasses\shipping_methods\ukr-poshta\ajax\mrkv-ua-shipping-methods-ajax-ukr.php:19
authwp_ajax_mrkv_ua_ship_ukr_poshta_warehouseclasses\shipping_methods\ukr-poshta\ajax\mrkv-ua-shipping-methods-ajax-ukr.php:21
noprivwp_ajax_mrkv_ua_ship_ukr_poshta_warehouseclasses\shipping_methods\ukr-poshta\ajax\mrkv-ua-shipping-methods-ajax-ukr.php:22
authwp_ajax_mrkv_ua_ship_ukr_poshta_streetclasses\shipping_methods\ukr-poshta\ajax\mrkv-ua-shipping-methods-ajax-ukr.php:24
noprivwp_ajax_mrkv_ua_ship_ukr_poshta_streetclasses\shipping_methods\ukr-poshta\ajax\mrkv-ua-shipping-methods-ajax-ukr.php:25
authwp_ajax_mrkv_ua_ship_ukr_poshta_houseclasses\shipping_methods\ukr-poshta\ajax\mrkv-ua-shipping-methods-ajax-ukr.php:27
noprivwp_ajax_mrkv_ua_ship_ukr_poshta_houseclasses\shipping_methods\ukr-poshta\ajax\mrkv-ua-shipping-methods-ajax-ukr.php:28
authwp_ajax_mrkv_ua_ship_ukr_poshta_warehouse_idclasses\shipping_methods\ukr-poshta\ajax\mrkv-ua-shipping-methods-ajax-ukr.php:30
noprivwp_ajax_mrkv_ua_ship_ukr_poshta_warehouse_idclasses\shipping_methods\ukr-poshta\ajax\mrkv-ua-shipping-methods-ajax-ukr.php:31
authwp_ajax_mrkv_ua_ship_ukr_poshta_address_idclasses\shipping_methods\ukr-poshta\ajax\mrkv-ua-shipping-methods-ajax-ukr.php:33
noprivwp_ajax_mrkv_ua_ship_ukr_poshta_address_idclasses\shipping_methods\ukr-poshta\ajax\mrkv-ua-shipping-methods-ajax-ukr.php:34

REST API Routes 1

GET/wp-json/mrkv_ua_shipping/v1/check_ttnclasses\shipping_methods\mrkv-ua-shipping-methods-cron.php:27
WordPress Hooks 35
actionadmin_enqueue_scriptsclasses\settings\admin\mrkv-ua-shipping-admin-assets.php:19
actionadmin_menuclasses\settings\admin\mrkv-ua-shipping-menu.php:25
actionadmin_initclasses\settings\admin\mrkv-ua-shipping-notification.php:18
actionadmin_noticesclasses\settings\admin\mrkv-ua-shipping-notification.php:19
actionadmin_initclasses\settings\global\mrkv-ua-shipping-options.php:19
actionwoocommerce_order_status_changedclasses\shipping_methods\mrkv-ua-shipping-methods-autocreate.php:19
actionwoocommerce_checkout_order_processedclasses\shipping_methods\mrkv-ua-shipping-methods-autocreate.php:22
actionwoocommerce_checkout_processclasses\shipping_methods\mrkv-ua-shipping-methods-checkout-validation.php:43
filterwoocommerce_checkout_fieldsclasses\shipping_methods\mrkv-ua-shipping-methods-checkout-validation.php:44
actionwoocommerce_before_checkout_formclasses\shipping_methods\mrkv-ua-shipping-methods-checkout.php:26
filterwoocommerce_cart_shipping_packagesclasses\shipping_methods\mrkv-ua-shipping-methods-checkout.php:27
filterwoocommerce_checkout_fieldsclasses\shipping_methods\mrkv-ua-shipping-methods-checkout.php:28
actionwp_loadedclasses\shipping_methods\mrkv-ua-shipping-methods-cron.php:19
actionmrknp_ua_shipping_nova_poshta_statusesclasses\shipping_methods\mrkv-ua-shipping-methods-cron.php:20
actionrest_api_initclasses\shipping_methods\mrkv-ua-shipping-methods-cron.php:22
actionwoocommerce_checkout_create_orderclasses\shipping_methods\mrkv-ua-shipping-methods-order.php:18
actionwp_loadedclasses\shipping_methods\mrkv-ua-shipping-methods.php:31
actionadd_meta_boxesclasses\woocommerce\mrkv-ua-shipping-woo-order.php:21
actionwoocommerce_admin_order_data_after_billing_addressclasses\woocommerce\mrkv-ua-shipping-woo-order.php:23
actionwoocommerce_admin_order_data_after_shipping_addressclasses\woocommerce\mrkv-ua-shipping-woo-order.php:24
actionwoocommerce_process_shop_order_metaclasses\woocommerce\mrkv-ua-shipping-woo-order.php:25
filtermanage_woocommerce_page_wc-orders_columnsclasses\woocommerce\mrkv-ua-shipping-woo-orders.php:22
actionmanage_woocommerce_page_wc-orders_custom_columnclasses\woocommerce\mrkv-ua-shipping-woo-orders.php:23
filtermanage_edit-shop_order_columnsclasses\woocommerce\mrkv-ua-shipping-woo-orders.php:26
actionmanage_shop_order_posts_custom_columnclasses\woocommerce\mrkv-ua-shipping-woo-orders.php:27
actionadmin_footerclasses\woocommerce\mrkv-ua-shipping-woo-orders.php:30
filterwoocommerce_account_orders_columnsclasses\woocommerce\mrkv-ua-shipping-woo-orders.php:32
actionwoocommerce_my_account_my_orders_column_mrkv_ua_ship_ttn-columnclasses\woocommerce\mrkv-ua-shipping-woo-orders.php:33
filterwoocommerce_product_data_tabsclasses\woocommerce\mrkv-ua-shipping-woo-product.php:21
actionwoocommerce_product_data_panelsclasses\woocommerce\mrkv-ua-shipping-woo-product.php:22
actionwoocommerce_process_product_metaclasses\woocommerce\mrkv-ua-shipping-woo-product.php:23
actionbefore_woocommerce_initmrkv-ua-shipping.php:20
actioninitmrkv-ua-shipping.php:49
actionwoocommerce_shipping_initmrkv-ua-shipping.php:52
filterwoocommerce_shipping_methodsmrkv-ua-shipping.php:78
Maintenance & Trust

Morkva UA Shipping Maintenance & Trust

Maintenance Signals

WordPress version tested6.9.4
Last updatedApr 14, 2026
PHP min version7.4
Downloads17K

Community Trust

Rating98/100
Number of ratings22
Active installs900
Alternatives

Morkva UA Shipping Alternatives

WC Ukraine Shipping – Integration of Nova Poshta and Ukrposhta for WooCommerce

WC Ukraine Shipping – Integration of Nova Poshta and Ukrposhta for WooCommerce

wc-ukr-shipping

A
100

Connect Nova Poshta, Ukrposhta, Meest or international delivery services with your store. Create labels, track orders and calculate rates in one place &hellip;

7K No CVEs
Shipping for Nova Poshta

Shipping for Nova Poshta

nova-poshta-ttn

A
98

Доставка на відділення, поштомат та адресу (з автопошуком вулиць). Створення ТТН. Найзручніший плагін.

500 1 CVE
Ukrposhta

Ukrposhta

woo-ukrposhta

A
99

Створюйте експрес-накладні автоматично, на сторінці замовлення. 10% знижка на відправлення, створені онлайн за допомогою API Ukrposhta.

500 1 CVE
Woo NovaPoshta. Электронная накладная

Woo NovaPoshta. Электронная накладная

nova-poshta-declarations

A
85

Новая почта электронные накладные. Вывод электронных накладных в заказе (woocommerce).

10 No CVEs
Shipping of Nova Poshta for WooCommerce

Shipping of Nova Poshta for WooCommerce

wc-nova-poshta-for-shop

A
100

Підключення служби доставки Нова Пошта до Вашого сайту (WooCommerce)

10 No CVEs
Developer Profile

Morkva UA Shipping Developer Profile

Ihor Kit

14 plugins · 3K total installs

93
trust score
Avg Security Score
98/100
Avg Patch Time
11 days
View full developer profile
Detection Fingerprints

How We Detect Morkva UA Shipping

Patterns used to identify this plugin on WordPress sites during automated security audits and web crawling.

Asset Fingerprints

Asset Paths
/wp-content/plugins/morkva-ua-shipping/assets/css/global/global-mrkv-ua-shipping.css/wp-content/plugins/morkva-ua-shipping/assets/js/global/select2.min.js/wp-content/plugins/morkva-ua-shipping/assets/js/global/global-mrkv-ua-shipping.js/wp-content/plugins/morkva-ua-shipping/assets/js/global/global-mrkv-ua-shipping-nova-poshta.js/wp-content/plugins/morkva-ua-shipping/assets/js/global/global-mrkv-ua-shipping-ukrposhta.js/wp-content/plugins/morkva-ua-shipping/assets/css/nova-poshta/nova-poshta-mrkv-ua-shipping.css/wp-content/plugins/morkva-ua-shipping/assets/js/nova-poshta/nova-poshta-mrkv-ua-shipping.js/wp-content/plugins/morkva-ua-shipping/assets/css/ukrposhta/ukrposhta-mrkv-ua-shipping.css+1 more
Script Paths
/wp-content/plugins/morkva-ua-shipping/assets/js/global/select2.min.js/wp-content/plugins/morkva-ua-shipping/assets/js/global/global-mrkv-ua-shipping.js/wp-content/plugins/morkva-ua-shipping/assets/js/global/global-mrkv-ua-shipping-nova-poshta.js/wp-content/plugins/morkva-ua-shipping/assets/js/global/global-mrkv-ua-shipping-ukrposhta.js/wp-content/plugins/morkva-ua-shipping/assets/js/nova-poshta/nova-poshta-mrkv-ua-shipping.js/wp-content/plugins/morkva-ua-shipping/assets/js/ukrposhta/ukrposhta-mrkv-ua-shipping.js
Version Parameters
morkva-ua-shipping/assets/css/global/global-mrkv-ua-shipping.css?ver=morkva-ua-shipping/assets/js/global/select2.min.js?ver=morkva-ua-shipping/assets/js/global/global-mrkv-ua-shipping.js?ver=morkva-ua-shipping/assets/js/global/global-mrkv-ua-shipping-nova-poshta.js?ver=morkva-ua-shipping/assets/js/global/global-mrkv-ua-shipping-ukrposhta.js?ver=morkva-ua-shipping/assets/css/nova-poshta/nova-poshta-mrkv-ua-shipping.css?ver=morkva-ua-shipping/assets/js/nova-poshta/nova-poshta-mrkv-ua-shipping.js?ver=morkva-ua-shipping/assets/css/ukrposhta/ukrposhta-mrkv-ua-shipping.css?ver=morkva-ua-shipping/assets/js/ukrposhta/ukrposhta-mrkv-ua-shipping.js?ver=

HTML / DOM Fingerprints

CSS Classes
mrkv-ua-shipping-admin-settingsmrkv-ua-shipping-order-details
Data Attributes
data-nonce-field
JS Globals
mrkv_ua_ship_helperMRKV_UA_SHIPPING_PLUGIN_VERSION
FAQ

Frequently Asked Questions about Morkva UA Shipping