EUVD-2026-43345Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSubmit crafted input via Cart Lift capture form
-
DeliveryPayload stored unsanitized in plugin data
-
ExploitAdmin opens abandoned-cart dashboard
-
ExecutionStored script executes in admin browser
-
ImpactHijack session or forge admin actions
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the attacker to get a malicious value stored by Cart Lift (via its cart/lead capture inputs) and then requires a victim - most plausibly a WordPress administrator or staff member - to view the page where that stored value is rendered (UI:R in the CVSS vector). Per PR:N the attacker needs no authentication to plant the payload, but the attack is limited by that required victim interaction and by the need for the Cart Lift plugin to be installed and active (versions ≤ 3.1.57); it does not grant direct server-side code execution, and impact is bounded to browser-context script execution in whoever loads the poisoned page. |
| Impact | The provided CVSS 3.1 score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) reflects network reach, low complexity, no privileges, but required user interaction and only low-magnitude confidentiality/integrity/availability impact, elevated by a changed scope. No EPSS score, KEV entry, or POC was provided, so there is no evidence of active or automated exploitation - this is a Patchstack-sourced advisory rather than a signal of in-the-wild abuse. The PR:N/UI:R combination indicates an attacker needs no account but does need a victim to load the poisoned page, which typically points to a semi-targeted attack (e.g., a store admin opening the cart dashboard) rather than mass automated exploitation. Net: a legitimately patch-worthy stored XSS, but a moderate operational priority absent POC/KEV signals - treat as important for any live store running the plugin, not an emergency. |
| Exploit ScenarioDerived | An attacker submits a crafted cart or contact value containing a script payload through a customer-facing Cart Lift capture flow; the value is stored and later rendered when a store administrator opens the abandoned-cart dashboard, executing the script in the admin's authenticated session. Given the network vector and low complexity, the payload could attempt session/cookie theft or admin action forgery; no public POC is currently identified, so this remains a plausible rather than demonstrated chain. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 13, 2026
Stored cross-site scripting in the RexTheme Cart Lift WordPress plugin (versions up to and including 3.1.57) lets an attacker persist malicious JavaScript that executes in a victim's browser when the affected page is viewed. Because the CVSS scope is marked changed, injected script can affect resources beyond the vulnerable component, such as the WordPress admin session viewing abandoned-cart data. No public exploit has been identified at time of analysis and the issue is not listed in CISA KEV, but stored XSS in a customer-facing e-commerce recovery plugin is a realistic session-hijacking and admin-compromise vector.
RemediationAI
No vendor-released patched version is identified in the provided data - the advisory only confirms all versions up to and including 3.1.57 are vulnerable - so administrators should monitor RexTheme/Patchstack (https://patchstack.com/database/Wordpress/Plugin/cart-lift/vulnerability/wordpress-cart-lift-plugin-3-1-57-cross-site-scripting-xss-vulnerability) for a release above 3.1.57 and upgrade to it as soon as it is published. As compensating controls until a fix ships, restrict who can view the Cart Lift abandoned-cart/reporting screens to trusted admins only, deploy a Web Application Firewall (Patchstack's virtual patching or equivalent) to filter script payloads reaching the plugin's capture endpoints, and consider a Content-Security-Policy that disallows inline script to blunt execution - noting CSP can break legitimate inline scripts in some themes and should be tested in staging. If recovery workflows are not actively used, temporarily deactivating the plugin removes the exposure entirely at the cost of losing abandoned-cart recovery functionality.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Cart Lift is a WooCommerce/WordPress abandoned-cart recovery plugin (CPE cpe:2.3:a:rextheme:cart_lift) that captures shopper cart and contact data and surfaces it in the WordPress admin and recovery workflows. The flaw is CWE-79, Improper Neutralization of Input During Web Page Generation, meaning attacker-supplied input is stored and later rendered into an HTML page without adequate output encoding or sanitization. When that stored value is echoed back - for example into an admin listing of captured/abandoned carts or into a recovery page - the embedded script runs in the context of whoever views it, inheriting their DOM and session.
Know when Cart Lift gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Unauthenticated network injection (PR:N/AV:N) but stored payload needs a victim to view it (UI:R); scope change from browser context (S:C) with low confidentiality/integrity impact and no meaningful availability effect (A:N).
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RexTheme Cart Lift cart-lift allows Stored XSS.This issue affects Cart Lift: from n/a through <= 3.1.57.
Executive ViewAI
RexTheme Cart Lift WordPress plugin (versions ≤ 3.1.57) contains a vulnerability that enables attackers to inject malicious code into cart-recovery pages viewed by customers and WordPress administrators. Successful exploitation could compromise administrative accounts and customer sessions, putting e-commerce operations and customer data at organizational risk. No vendor patch is currently available.
Implement Web Application Firewall (WAF) rules to block script injection patterns; restrict WordPress administrative access to corporate VPN or IP allowlist; enable enhanced logging on admin sessions; and isolate the plugin from production environments if operations permit.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
GitHub PoC
Exploit-DB