WordPress Plugin Vulnerabilities

Smoove Abandoned Cart Trigger for WooCommerce 4.0.0 - 4.3.5 - Unauthenticated Stored XSS

Description

The plugin does not sanitise and escape abandoned-cart data submitted by visitors before outputting it in the admin dashboard, allowing unauthenticated users to perform Stored Cross-Site Scripting attacks against administrators.

Proof of Concept

Affects Plugins

Plugin icon
smoove-abandoned-cart-trigger-for-woocommerce
Fixed in 4.3.6

References

CVE
CVE-2026-123134

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
8.8 (high)

Miscellaneous

Original Researcher
Naoki Kawahigashi
Submitter
Naoki Kawahigashi
Verified
Yes
WPVDB ID
ad3a49ed-4740-4503-9c08-8c0fac5fc270

Timeline

Publicly Published
2026-11-09 (about 2 days ago)
Added
2026-11-09 (about 1 day ago)
Last Updated
2026-11-10 (about 7 hours ago)

Other

Published
Title
Published
2021-09-27
Title
WooCommerce Product Table Lite < 2.4.0 - Reflected Cross-Site Scripting
Published
2026-07-10
Title
Themify Builder < 7.7.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'height_slider' Slider Module Field
Published
2026-04-03
Title
Visitor Traffic Real Time Statistics < 8.5 - Unauthenticated Stored Cross-Site Scripting
Published
2016-04-21
Title
Tweet Wheel <= 1.0.3.2 - Reflected Cross-Site Scripting (XSS)
Published
2023-05-05
Title
WPO365 < 1.9.1 - Reflected XSS