starship / search / myparcel-nl-1

Audit report

MyParcel NL

Broad accessReach : broadSensitive Access

by MyParcel · Orders and shipping · Shopify App Store

Orders and shipping

Risk level

Broad access

Executive summary

Voordelig en gemakkelijk pakketten versturen met MyParcel

Key insights

◆Dutch carrier-aggregation / shipping-label app, EU publisher (MyParcel B.V., Netherlands).
◆Publisher claims ISO/IEC 27001 via badge on website, not independently verified.
◆TLS clean (HTTP/2, HSTS 2y) on publisher primary domain; no CSP advertised.
◆Two recent reflected-XSS CVEs (2024 and 2025) in same publisher's WordPress plugins -- input validation hygiene flag.

Top findings

No critical or high findings detected.

Synthesis

Analysis summary

Voordelig en gemakkelijk pakketten versturen met MyParcel

Key insights

◆Dutch carrier-aggregation / shipping-label app, EU publisher (MyParcel B.V., Netherlands).
◆Publisher claims ISO/IEC 27001 via badge on website, not independently verified.
◆TLS clean (HTTP/2, HSTS 2y) on publisher primary domain; no CSP advertised.
◆Two recent reflected-XSS CVEs (2024 and 2025) in same publisher's WordPress plugins -- input validation hygiene flag.
◆App reads orders and writes shipping/fulfillment data (declared scopes not parsed from listing, inferred from shipping-app pattern).
◆Rating 4.6 / 53 reviews; not Built-for-Shopify.

Detections

Findings (4)

Risks detected through static, network, and policy analysis.

Reflected XSS in publisher's WordPress plugin (CVE-2024-9608)

Medium

The MyParcel WordPress plugin (same publisher) had a Reflected Cross-Site Scripting vulnerability in versions <= 4.24.1 (CVSS 7.1, Medium). Fixed in 4.24.2. Demonstrates a recent input-validation defect in the publisher's product portfolio. Not directly in the Shopify app, but reflects publisher engineering hygiene.

Evidence

https://github.com/advisories/GHSA-jrvp-2cf5-695g

Reflected XSS in publisher's WC MyParcel Belgium plugin (CVE-2025-48279)

Medium

WC MyParcel Belgium plugin <= 4.5.5-beta has Reflected XSS (CVSS 7.1). Fixed in 4.5.6, published 2025-06-03. Another publisher input-validation issue.

Evidence

https://patchstack.com/database/wordpress/plugin/wc-myparcel-belgium/vulnerability/wordpress-wc-myparcel-belgium-plugin-4-5-5-beta-reflected-cross-site-scripting-xss-vulnerability

No Content-Security-Policy header on publisher domain

Low

HTTPS HEAD response from https://www.myparcel.nl/ returns HSTS (max-age=63072000) and x-content-type-options:nosniff but does not advertise a Content-Security-Policy header. CSP would reduce XSS blast radius on the marketing/admin surface.

Evidence

https://www.myparcel.nl/

Privacy policy hosted as PDF and partially inaccessible

Info

Privacy statement URL referenced from app listing (assets.myparcel.nl/.../myparcel-privacy-statement.pdf) returns HTTP 403 when fetched programmatically; data residency, sub-processors and retention period not enumerable in public HTML. Reduces auditability.

Evidence

https://assets.myparcel.nl/documentatie/voorwaarden/myparcel-privacy-statement.pdf

This section is available to signed-in users

Get started

Permissions

OAuth scopes requested

These are the access permissions this app asks for during install. The sensitivity column reflects PII exposure and merchant impact.

Scope	Sensitivity	Why we flag it
`read_orders`	High	Required to read order line items, customer shipping addresses to create labels.
`write_orders`	High	Inferred for marking orders as fulfilled / attaching tracking. Allows modification of order state.
`read_customers`	High	Customer PII (name, address, phone) needed for carrier handover.
`write_fulfillments`	High	Standard for shipping apps -- create fulfillments and attach tracking numbers.
`read_shipping`	Medium	Read shipping zones/rates to determine carrier routing.

read_orders

High

Required to read order line items, customer shipping addresses to create labels.

write_orders

High

Inferred for marking orders as fulfilled / attaching tracking. Allows modification of order state.

read_customers

High

Customer PII (name, address, phone) needed for carrier handover.

write_fulfillments

High

Standard for shipping apps -- create fulfillments and attach tracking numbers.

read_shipping

Medium

Read shipping zones/rates to determine carrier routing.

This section is available to signed-in users

Get started

This section is available to signed-in users

Get started

Attack surface

Network surface

Primary domain: myparcel.nl
TLS grade: A
HSTS: Enabled
CSP: Missing

HSTS max-age=63072000 present; no Content-Security-Policy header; x-content-type-options:nosniff; referrer-policy:same-origin.

Posture

Compliance & certifications

GDPR webhooks Pass

SOC 2 Type II Fail

ISO 27001 Pass

PCI DSS Fail

EU publisher subject to GDPR by jurisdiction. ISO/IEC 27001 badge displayed on publisher site (not independently verified against an issuing CB). SOC2/PCI not advertised.

Track record

Publisher reputation

Publisher: MyParcel
Verified Shopify Partner: No
Years active: 10
Other apps: 1

Past incidents

●CVE-2024-9608 -- Reflected XSS in MyParcel WordPress plugin (Medium, fixed)
●CVE-2025-48279 -- Reflected XSS in WC MyParcel Belgium plugin (Medium, fixed)

LLM exposure

AI / LLM usage

No LLM usage detected. This app does not appear to forward any customer or merchant data to large-language-model providers.

MyParcel NL

Key insights

Top findings

Analysis summary

Findings (4)

Reflected XSS in publisher's WordPress plugin (CVE-2024-9608)

Reflected XSS in publisher's WC MyParcel Belgium plugin (CVE-2025-48279)

No Content-Security-Policy header on publisher domain

Privacy policy hosted as PDF and partially inaccessible

OAuth scopes requested

Data flow

Theme code analysis

Network surface

Compliance & certifications

Publisher reputation

AI / LLM usage