Stored Cross-Site Scripting in Abandoned Cart Lite and Pro Plugins for WordPress
CVE-2019-25152
7.2HIGH
Key Information:
- Vendor
Wordpress
- Vendor
- CVE Published:
- 22 June 2023
What is CVE-2019-25152?
The Abandoned Cart Lite and Pro for WooCommerce plugins are susceptible to Stored Cross-Site Scripting due to inadequate input sanitization and escaping of output. Attackers can exploit this flaw by injecting malicious scripts through various parameters, allowing unauthorized execution of scripts within the admin dashboard. This vulnerability impacts multiple plugin versions, making it critical for site owners to update and secure their installations to prevent potential exploitation.
Affected Version(s)
Abandoned Cart Lite for WooCommerce * < 5.2.0
Abandoned Cart Pro for WooCommerce * <= 7.12.0