CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
What the vulnerability does
The Abandoned Cart Lite for WooCommerce and Abandoned Cart Pro for WooCommerce plugins for WordPress are vulnerable to Stored Cross-Site Scripting via multiple parameters in versions up to, and including, 5.1.3 and 7.12.0 respectively, due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in user input that will execute on the admin dashboard.
Explanation of Vulnerability in Simple Terms
Abandoned Cart Lite for WooCommerce versions before 5.2.0 contain a cross-site scripting (XSS) vulnerability that allows attackers to inject malicious scripts into the site without authentication. The vulnerability affects the plugin's handling of user input, enabling attackers to execute JavaScript in visitors' browsers and potentially steal session tokens or redirect users to malicious sites. Site owners should update to version 5.2.0 or later immediately.
What an attacker can do
Inject malicious JavaScript that runs in visitors' browsers and steals session data or redirects users.
Potential impact on your site
Visitors' browsers can be compromised; session tokens and credentials may be stolen without your knowledge.
Conditions required to exploit
No authentication or user interaction required; attacker can exploit the vulnerability remotely.
Key dates
External resources
Related vulnerabilities
