EUVD-2026-49232
GHSA-wf3g-p4jm-gx88
Severity by source
AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L
Primary rating from Vendor (Patchstack) · only source for this CVE.
CVSS VectorVendor: Patchstack
Lifecycle Timeline
2DescriptionCVE.org
Shop manager Cross Site Scripting (XSS) in Abandoned Cart Lite for WooCommerce <= 6.8.0 versions.
AnalysisAI
Cross-site scripting (XSS) in Abandoned Cart Lite for WooCommerce allows authenticated shop managers with high privileges to inject malicious scripts, potentially leading to account takeover or data theft when an administrator views crafted content. No public exploit identified at time of analysis.
The Abandoned Cart Lite for WooCommerce plugin for WordPress is vulnerable to authentication bypass in versions up to, a
The Abandoned Cart Lite for WooCommerce and Abandoned Cart Pro for WooCommerce plugins for WordPress are vulnerable to S
Authentication bypass in the Abandoned Cart Lite for WooCommerce WordPress plugin before 6.8.2 allows unauthenticated at
Auth. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor pat
The Abandoned Cart Lite for WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today