CVE-2026-123134 | BDVDB-2026-404807 Detail

Smoove abandoned cart trigger for WooCommerce

Description#

The Smoove abandoned cart trigger for WooCommerce WordPress plugin before 4.3.6 does not sanitise and escape abandoned-cart data submitted by visitors before outputting it in the admin dashboard, allowing unauthenticated users to perform Stored Cross-Site Scripting attacks against administrators.

Impact#

No impact statement in the source data.

Weaknesses#

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

References#

https://wpscan.com/vulnerability/ad3a49ed-4740-4503-9c08-8c0fac5fc270/

Exploit#

https://wpscan.com/vulnerability/ad3a49ed-4740-4503-9c08-8c0fac5fc270/

History#

Version 12026-11-11Record published in the CVE List.