CVE-2026-32526: Stored XSS in Abandoned Cart Recovery for WooCommerce

The Stored XSS vulnerability allows an attacker to inject arbitrary JavaScript code into the plugin's data storage. When a legitimate user views a page containing the injected script, the script executes in their browser context. This can lead to various malicious outcomes, including session hijacking, redirection to phishing sites, defacement of the website, and theft of sensitive user data like login credentials or personal information. The impact is amplified if the plugin is widely used or handles sensitive data, potentially affecting a large number of users and compromising the integrity of the entire WooCommerce store.

1. Reserved2026-03-12
2. Published2026-03-25
3. Modified2026-04-29
4. EPSS updated2026-04-02

The primary mitigation is to immediately upgrade the Abandoned Cart Recovery for WooCommerce plugin to version 1.1.11 or later. If upgrading is not immediately feasible due to compatibility issues or breaking changes, consider temporarily disabling the plugin to prevent further exploitation. While a direct fix is preferred, web application firewalls (WAFs) can be configured to filter out suspicious XSS payloads targeting the plugin's endpoints. Regularly review and sanitize user inputs within the plugin's code to prevent future XSS vulnerabilities. After upgrading, confirm the vulnerability is resolved by attempting to inject a simple JavaScript payload through the plugin's input fields and verifying that it does not execute.

Active installs

4KNiche

Plugin rating

4.5

Requires WordPress

5.0+

Compatible up to

6.9.4

Requires PHP

7.0+