Stored Cross-Site Scripting Flaw in WooCommerce Plugin by Smoove
CVE-2026-123134
Currently unrated
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 11 November 2026
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-123134?
The WooCommerce plugin by Smoove, prior to version 4.3.6, is susceptible to a stored cross-site scripting vulnerability. This occurs because the plugin fails to properly sanitize and escape abandoned cart data submitted by users before displaying it in the admin dashboard. As a result, unauthenticated attackers could exploit this flaw to execute malicious scripts in the context of the administrator's browser, potentially compromising site security.
Affected Version(s)
Smoove abandoned cart trigger for WooCommerce 4.0.0 < 4.3.6
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.