Abandoned Cart Lite for WooCommerce vulnerabilities
3 known CVE vulnerabilities in Abandoned Cart Lite for WooCommerce, translated and rated.
- CVE-2026-65557Medium
The Abandoned Cart Lite for WooCommerce plugin version 6.8.0 and earlier contains a Cross-Site Scripting (XSS) vulnerability for users with the Shop Manager role. A Shop Manager can inject malicious scripts.
- CVE-2026-57637Medium
Unauthenticated Cross Site Request Forgery (CSRF) vulnerability in Abandoned Cart Lite for WooCommerce versions up to 6.8.0. An attacker can trick an administrator into performing unintended actions without their knowledge.
- CVE-2026-12585High
The Abandoned Cart Lite for WooCommerce WordPress plugin before version 6.8.2 does not protect the integrity of its cart-recovery tokens or bind them to the requesting account. This allows unauthenticated attackers to forge a recovery link that logs them in as another user when the automatic-login option is enabled.