What is the CVSS score of CVE-2026-32526?

CVE-2026-32526 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.0%.

Which versions of WordPress are affected by CVE-2026-32526?

CVE-2026-32526 presents moderate security risk, a cross-site scripting vulnerability rated CVSS 7.1.

How to fix or mitigate CVE-2026-32526?

Within 7 days: Identify all affected systems and apply vendor patches promptly. Verify anti-CSRF tokens and content security policies are enforced.

WordPress CVE-2026-32526

EUVD-2026-15891 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-03-25 Patchstack

GHSA-x63r-jhq3-w5rq

XSS WordPress

7.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Re-analysis Queued

Apr 24, 2026 - 16:37 vuln.today

cvss_changed

EUVD ID Assigned

Mar 25, 2026 - 16:47 euvd

EUVD-2026-15891

Analysis Generated

Mar 25, 2026 - 16:47 vuln.today

CVE Published

Mar 25, 2026 - 16:15 nvd

HIGH 7.1

DescriptionCVE.org

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VillaTheme Abandoned Cart Recovery for WooCommerce woo-abandoned-cart-recovery allows Stored XSS.This issue affects Abandoned Cart Recovery for WooCommerce: from n/a through <= 1.1.10.

AnalysisAI

A Stored Cross-Site Scripting (XSS) vulnerability exists in VillaTheme's Abandoned Cart Recovery for WooCommerce plugin affecting versions up to and including 1.1.10. The vulnerability allows attackers to inject malicious JavaScript code that persists in the application and executes in the browsers of administrators and customers when vulnerable pages are viewed. An attacker with appropriate access can compromise user sessions, steal sensitive data, or perform unauthorized actions on behalf of legitimate users.

Technical ContextAI

The vulnerability stems from improper neutralization of user-supplied input during web page generation, classified under CWE-79 (Improper Neutralization of Input During Web Page Generation). The affected product is the VillaTheme Abandoned Cart Recovery for WooCommerce plugin (CPE: cpe:2.3:a:villatheme:abandoned_cart_recovery_for_woocommerce:*:*:*:*:*:*:*:*), a WordPress extension designed to recover lost sales by tracking and recovering abandoned shopping carts. The plugin fails to properly sanitize or escape user-controlled input before rendering it in HTML context, allowing attackers to inject arbitrary JavaScript payloads that are stored in the application's database and executed whenever the vulnerable component is accessed. This is a stored XSS vulnerability, meaning the malicious payload persists and affects multiple users rather than requiring per-victim social engineering.

RemediationAI

Immediately upgrade the Abandoned Cart Recovery for WooCommerce plugin to a version higher than 1.1.10 (check the official VillaTheme repository or WordPress plugin directory for the latest patched release). If an updated version is not yet available, deactivate and remove the plugin entirely until a security patch is released. For WordPress administrators unable to immediately patch, implement additional defense-in-depth measures: enforce strict Content Security Policy (CSP) headers to restrict inline script execution, use WordPress security plugins to monitor and filter database content for malicious payloads, enable WordPress user role restrictions to limit plugin access to essential administrators only, and monitor user activity logs for signs of exploitation. Consult the Patchstack security advisory (https://patchstack.com/database/Wordpress/Plugin/woo-abandoned-cart-recovery/) for vendor-specific remediation guidance and patch availability timelines.