CVE-2026-65557
MediumCVSS 5.9Summary
The Abandoned Cart Lite for WooCommerce plugin version 6.8.0 and earlier contains a Cross-Site Scripting (XSS) vulnerability for users with the Shop Manager role. A Shop Manager can inject malicious scripts.
Risk Assessment
The risk involves script execution in the context of an administrator or customers, potentially leading to cart data or session theft.
Recommendation
Update Abandoned Cart Lite for WooCommerce to a version newer than 6.8.0 that includes an XSS fix.
Other vulnerabilities in Abandoned Cart Lite for WooCommerce
See all- CVE-2026-57637Medium
Unauthenticated Cross Site Request Forgery (CSRF) vulnerability in Abandoned Cart Lite for WooCommerce versions up to 6.8.0. An attacker can trick an administrator into performing unintended actions without their knowledge.
- CVE-2026-12585High
The Abandoned Cart Lite for WooCommerce WordPress plugin before version 6.8.2 does not protect the integrity of its cart-recovery tokens or bind them to the requesting account. This allows unauthenticated attackers to forge a recovery link that logs them in as another user when the automatic-login option is enabled.
Original NVD description (English source)
Shop manager Cross Site Scripting (XSS) in Abandoned Cart Lite for WooCommerce <= 6.8.0 versions.