Abandoned Cart Lite For Woocommerce
Monthly
Authentication bypass in the Abandoned Cart Lite for WooCommerce WordPress plugin before 6.8.2 allows unauthenticated attackers to forge cart-recovery links that log them in as arbitrary users when the automatic-login feature is enabled. Because recovery tokens are neither integrity-protected nor bound to the requesting account, an attacker can craft a link that authenticates them as a victim, yielding full account takeover (SSVC technical impact: total). Publicly available exploit code exists (WPScan), though it is not listed in CISA KEV and EPSS is low (0.14%).
Cross-site scripting (XSS) in Abandoned Cart Lite for WooCommerce allows authenticated shop managers with high privileges to inject malicious scripts, potentially leading to account takeover or data theft when an administrator views crafted content. No public exploit identified at time of analysis.
Auth. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The Abandoned Cart Lite for WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.8.5. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Request Forgery (CSRF) vulnerability could allow attackers to trick authenticated users into performing unintended actions.
The Abandoned Cart Lite for WooCommerce and Abandoned Cart Pro for WooCommerce plugins for WordPress are vulnerable to Stored Cross-Site Scripting via multiple parameters in versions up to, and. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 27.1%.
The Abandoned Cart Lite for WooCommerce plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 5.14.2. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 91.4%.
Authentication bypass in the Abandoned Cart Lite for WooCommerce WordPress plugin before 6.8.2 allows unauthenticated attackers to forge cart-recovery links that log them in as arbitrary users when the automatic-login feature is enabled. Because recovery tokens are neither integrity-protected nor bound to the requesting account, an attacker can craft a link that authenticates them as a victim, yielding full account takeover (SSVC technical impact: total). Publicly available exploit code exists (WPScan), though it is not listed in CISA KEV and EPSS is low (0.14%).
Cross-site scripting (XSS) in Abandoned Cart Lite for WooCommerce allows authenticated shop managers with high privileges to inject malicious scripts, potentially leading to account takeover or data theft when an administrator views crafted content. No public exploit identified at time of analysis.
Auth. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The Abandoned Cart Lite for WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.8.5. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Request Forgery (CSRF) vulnerability could allow attackers to trick authenticated users into performing unintended actions.
The Abandoned Cart Lite for WooCommerce and Abandoned Cart Pro for WooCommerce plugins for WordPress are vulnerable to Stored Cross-Site Scripting via multiple parameters in versions up to, and. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 27.1%.
The Abandoned Cart Lite for WooCommerce plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 5.14.2. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 91.4%.