Stored Cross-Site Scripting in Abandoned Cart Lite and Pro Plugins for WordPress
CVE-2019-25152

7.2HIGH

Key Information:

Vendor
Wordpress
Status
Abandoned Cart Pro For WooCommerce
Abandoned Cart Lite For WooCommerce
Vendor
CVE Published:
22 June 2023

Summary

The Abandoned Cart Lite and Pro for WooCommerce plugins are susceptible to Stored Cross-Site Scripting due to inadequate input sanitization and escaping of output. Attackers can exploit this flaw by injecting malicious scripts through various parameters, allowing unauthorized execution of scripts within the admin dashboard. This vulnerability impacts multiple plugin versions, making it critical for site owners to update and secure their installations to prevent potential exploitation.

Affected Version(s)

Abandoned Cart Lite for WooCommerce * < 5.2.0

Abandoned Cart Pro for WooCommerce * <= 7.12.0

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://www.wordfence.com/blog/2019/03/xss-flaw-in-abando...
https://plugins.trac.wordpress.org/changeset/2033212

CVSS V3.1

Score:
7.2
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.