CVE-2026-123134

Smoove abandoned cart trigger for WooCommerce unauthenticated stored XSS in abandoned cart data

high · 8.8

Fix listed

Smoove abandoned cart trigger for WooCommerce

Published Nov 11, 2026, 06:00 UTC

Description

The Smoove abandoned cart trigger for WooCommerce WordPress plugin before 4.3.6 does not sanitise and escape abandoned-cart data submitted by visitors before outputting it in the admin dashboard, allowing unauthenticated users to perform Stored Cross-Site Scripting attacks against administrators.

Reported fixed versions

4.3.6

Official CVE record View source and advisories

Data from cve.now. Summaries, where shown, are licensed CC BY 4.0.