CVE-2026-6370
Description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in HashThemes Mini Ajax Cart for WooCommerce allows Stored XSS.This issue affects Mini Ajax Cart for WooCommerce: from n/a through 1.3.4.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Stored XSS in Mini Ajax Cart for WooCommerce allows authenticated attackers to inject malicious scripts into pages, affecting versions up to 1.3.4.
Vulnerability
Description The Mini Ajax Cart for WooCommerce plugin suffers from a Stored Cross-Site Scripting (XSS) vulnerability due to improper neutralization of user input during web page generation. This flaw affects all versions from n/a through 1.3.4 [1].
Exploitation
Conditions Exploitation requires a privileged user to perform an action, such as clicking a malicious link or submitting a crafted form. Attackers can leverage this to target multiple websites in mass campaigns, regardless of site popularity [1].
Impact
Successful exploitation allows attackers to inject arbitrary JavaScript, leading to redirects, advertisements, or other HTML payloads that execute when visitors browse the affected site [1].
Mitigation
The vendor has released version 1.3.5 to patch this vulnerability. Users are strongly advised to update immediately or enable auto-updates for vulnerable plugins [1].
AI Insight generated on May 18, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.
Affected products
2- Range: <=1.3.4
- Range: <=1.3.4
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
1News mentions
1- Wordfence Intelligence Weekly WordPress Vulnerability Report (April 13, 2026 to April 19, 2026)Wordfence Blog · Apr 23, 2026