Unrated severityNVD Advisory· Published Nov 11, 2026

CVE-2026-123134

Description

The Smoove abandoned cart trigger for WooCommerce WordPress plugin before 4.3.6 does not sanitise and escape abandoned-cart data submitted by visitors before outputting it in the admin dashboard, allowing unauthenticated users to perform Stored Cross-Site Scripting attacks against administrators.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

WordPress/Smoove Abandoned Cart For Woocommerceinferred2 versions
<4.3.6+ 1 more
- (no CPE)range: <4.3.6
- (no CPE)range: <4.3.6
Package: https://wordpress.org/plugins/smoove-abandoned-cart-for-woocommerce

Patches

Vulnerability mechanics

References

wpscan.com/vulnerability/ad3a49ed-4740-4503-9c08-8c0fac5fc270/nvd

News mentions

No linked articles in our index yet.

cvss	0.000
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000