Stored Cross-Site Scripting in Abandoned Cart Lite and Pro Plugins for WordPress
CVE-2019-25152

7.2HIGH

Key Information:

Vendor

Wordpress
Status
Abandoned Cart Pro For WooCommerce
Abandoned Cart Lite For WooCommerce
Vendor
CVE Published:
22 June 2023

What is CVE-2019-25152?

The Abandoned Cart Lite and Pro for WooCommerce plugins are susceptible to Stored Cross-Site Scripting due to inadequate input sanitization and escaping of output. Attackers can exploit this flaw by injecting malicious scripts through various parameters, allowing unauthorized execution of scripts within the admin dashboard. This vulnerability impacts multiple plugin versions, making it critical for site owners to update and secure their installations to prevent potential exploitation.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

Abandoned Cart Lite for WooCommerce * < 5.2.0

Abandoned Cart Pro for WooCommerce * <= 7.12.0

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://www.wordfence.com/blog/2019/03/xss-flaw-in-abando...
https://plugins.trac.wordpress.org/changeset/2033212

EPSS Score

30% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
7.2
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.