WordPress security by component
Abandoned Cart Lite for WooCommerce
Plugin description
Abandoned Cart Lite for WooCommerce is a WordPress component with 3 published CVE records in this archive. The latest tracked vulnerability was published Jul 16, 2026; the highest published CVSS base score is 8.1.
Plugin slug:
abandoned-cart-lite-for-woocommerceLatest vulnerability
CVE-2026-12585: Abandoned Cart Lite for WooCommerce: A security weakness
Abandoned Cart Lite for WooCommerce is affected by a security weakness. The vulnerable path is reachable without authentication. The resulting impact depends on how the affected component exposes the vulnerable operation. The published affected range is < 6.8.2. The public source does not disclose the vulnerable endpoint, action, parameter or function, so the precise input path remains unknown.
| Safe version |
|
||
|---|---|---|---|
| Jul 16, 2026 |
CVE-2026-12585
Abandoned Cart Lite for WooCommerce: A security weakness
Abandoned Cart Lite for WooCommerce is affected by a security weakness. The vulnerable path is reachable without authentication. The resulting impact depends on how the affected component exposes the vulnerable operation. The published affected range is < 6.8.2. The public source does not disclose the vulnerable endpoint, action, parameter or function, so the precise input path remains unknown.
|
6.8.2 |
CVE8.1
NVDPending
|
| Jul 12, 2023 |
CVE-2021-4414
Abandoned Cart Lite for WooCommerce: Cross-site request forgery
Abandoned Cart Lite for WooCommerce is affected by cross-site request forgery. The vulnerable path is reachable without authentication. Exploitation relies on a signed-in privileged user submitting an attacker-controlled request. The public source does not disclose the vulnerable endpoint, action, parameter or function, so the precise input path remains unknown.
|
See mitigation notes |
CVE4.3
NVDPending
|
| Jun 22, 2023 |
CVE-2019-25152
Abandoned Cart Lite For Woocommerce: Cross-site scripting
Abandoned Cart Lite For Woocommerce is affected by cross-site scripting. The vulnerable path is reachable without authentication. Injected script can execute in the affected site's origin when the vulnerable output is viewed. The public source does not disclose the vulnerable endpoint, action, parameter or function, so the precise input path remains unknown.
|
See mitigation notes |
CVE7.2
NVD6.1
|