What is the CVSS score of CVE-2026-57417?

CVE-2026-57417 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.3%.

Which versions of Cart Lift are affected by CVE-2026-57417?

RexTheme Cart Lift WordPress plugin (versions ≤ 3.1.57) contains a vulnerability that enables attackers to inject malicious code into cart-recovery pages viewed by customers and WordPress…

How to fix or mitigate CVE-2026-57417?

Within 24 hours, identify all WordPress instances running Cart Lift plugin version 3.1.57 or earlier and document customer exposure. Within 7 days, either disable the plugin entirely or replace it with an alternative cart-recovery solution and review access logs for signs of compromise. Within 30 days, monitor RexTheme's security advisories for patch availability; if a patch is released, conduct security validation and deploy to all affected instances.

Cart Lift CVE-2026-57417

EUVD-2026-43345 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-07-13 Patchstack

WordPress XSS Wordpress Plugin Cart Lift Rextheme

7.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

6.1 MEDIUM

Unauthenticated network injection (PR:N/AV:N) but stored payload needs a victim to view it (UI:R); scope change from browser context (S:C) with low confidentiality/integrity impact and no meaningful availability effect (A:N).

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 13, 2026 - 10:54 vuln.today

CVE Published

Jul 13, 2026 - 08:41 cve.org

HIGH 7.1

DescriptionCVE.org

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RexTheme Cart Lift cart-lift allows Stored XSS.This issue affects Cart Lift: from n/a through <= 3.1.57.

AnalysisAI

Stored cross-site scripting in the RexTheme Cart Lift WordPress plugin (versions up to and including 3.1.57) lets an attacker persist malicious JavaScript that executes in a victim's browser when the affected page is viewed. Because the CVSS scope is marked changed, injected script can affect resources beyond the vulnerable component, such as the WordPress admin session viewing abandoned-cart data. No public exploit has been identified at time of analysis and the issue is not listed in CISA KEV, but stored XSS in a customer-facing e-commerce recovery plugin is a realistic session-hijacking and admin-compromise vector.

Technical ContextAI

Cart Lift is a WooCommerce/WordPress abandoned-cart recovery plugin (CPE cpe:2.3:a:rextheme:cart_lift) that captures shopper cart and contact data and surfaces it in the WordPress admin and recovery workflows. The flaw is CWE-79, Improper Neutralization of Input During Web Page Generation, meaning attacker-supplied input is stored and later rendered into an HTML page without adequate output encoding or sanitization. When that stored value is echoed back - for example into an admin listing of captured/abandoned carts or into a recovery page - the embedded script runs in the context of whoever views it, inheriting their DOM and session.

RemediationAI

No vendor-released patched version is identified in the provided data - the advisory only confirms all versions up to and including 3.1.57 are vulnerable - so administrators should monitor RexTheme/Patchstack (https://patchstack.com/database/Wordpress/Plugin/cart-lift/vulnerability/wordpress-cart-lift-plugin-3-1-57-cross-site-scripting-xss-vulnerability) for a release above 3.1.57 and upgrade to it as soon as it is published. As compensating controls until a fix ships, restrict who can view the Cart Lift abandoned-cart/reporting screens to trusted admins only, deploy a Web Application Firewall (Patchstack's virtual patching or equivalent) to filter script payloads reaching the plugin's capture endpoints, and consider a Content-Security-Policy that disallows inline script to blunt execution - noting CSP can break legitimate inline scripts in some themes and should be tested in staging. If recovery workflows are not actively used, temporarily deactivating the plugin removes the exposure entirely at the cost of losing abandoned-cart recovery functionality.