Abandoned Cart Recovery For Woocommerce CVE-2026-32526

VillaTheme Abandoned Cart Recovery for WooCommerce versions ≤1.1.10. Attacker must inject malicious JavaScript into a form field stored in the plugin database. The victim must visit a WooCommerce page where the stored payload is rendered, triggering XSS execution in their browser.

While CVSS and EPSS scores are not provided in the available intelligence, the vulnerability should be considered high-risk based on several factors. Stored XSS vulnerabilities are inherently dangerous because they affect all users who access the compromised content, including site administrators and customers. WordPress plugins have extensive attack surface exposure given their ubiquity and often permissive security posture. The vulnerability affects all versions through 1.1.10 with no explicit patch version identified, suggesting potentially incomplete remediation information. The attack vector is likely network-based (common for web vulnerabilities) with low to medium complexity. Reporting by Patchstack, a reputable WordPress security platform, and assignment of an ENISA EUVD ID (EUVD-2026-15891) indicates formal security community recognition. Without KEV (Known Exploited Vulnerabilities) designation or confirmed POC data in the provided intelligence, active exploitation cannot be confirmed, but the straightforward nature of XSS attacks means exploitation difficulty is typically low once vulnerability details are public.

An attacker with editor or administrator-level access (or via a separate vulnerability chain) could inject a malicious JavaScript payload into the abandoned cart recovery notification system or configuration fields. When site administrators or customers view their cart recovery notifications or when the plugin processes recovered cart data, the stored XSS payload executes in their browser context, allowing the attacker to steal session cookies, capture form submissions including payment data, redirect users to malicious sites, or create additional administrator accounts for persistent backdoor access. The low complexity of XSS exploitation combined with the persistent nature of stored variants makes this a practical attack vector in real-world WordPress environments.