WordPress Abandoned Cart Recovery for WooCommerce plugin <= 1.1.10 - Cross Site Scripting (XSS) kwetsbaarheid

The Stored XSS vulnerability allows an attacker to inject arbitrary JavaScript code into the plugin's data storage. When a legitimate user views a page containing the injected script, the script executes in their browser context. This can lead to various malicious outcomes, including session hijacking, redirection to phishing sites, defacement of the website, and theft of sensitive user data like login credentials or personal information. The impact is amplified if the plugin is widely used or handles sensitive data, potentially affecting a large number of users and compromising the integrity of the entire WooCommerce store.

WooCommerce store owners using the Abandoned Cart Recovery for WooCommerce plugin, particularly those running older versions (prior to 1.1.11), are at risk. Shared hosting environments where plugin updates are managed centrally are also at increased risk, as they may be slower to apply security patches.

• wordpress / composer / npm:

grep -r "villaTheme Abandoned Cart Recovery" /var/www/html/wp-content/plugins/
wp plugin list | grep abandoned-cart-recovery

• generic web:

curl -I https://your-wordpress-site.com/wp-admin/admin-ajax.php?action=abandoned_cart_recovery_save_data | grep -i content-security-policy

1. 2026-03-25Disclosure

   disclosure

1. Gereserveerd2026-03-12
2. Gepubliceerd2026-03-25
3. Gewijzigd2026-04-29
4. EPSS bijgewerkt2026-04-02

The primary mitigation is to immediately upgrade the Abandoned Cart Recovery for WooCommerce plugin to version 1.1.11 or later. If upgrading is not immediately feasible due to compatibility issues or breaking changes, consider temporarily disabling the plugin to prevent further exploitation. While a direct fix is preferred, web application firewalls (WAFs) can be configured to filter out suspicious XSS payloads targeting the plugin's endpoints. Regularly review and sanitize user inputs within the plugin's code to prevent future XSS vulnerabilities. After upgrading, confirm the vulnerability is resolved by attempting to inject a simple JavaScript payload through the plugin's input fields and verifying that it does not execute.

Actieve installaties

4KNiche

Plugin-beoordeling

4.5

Vereist WordPress

5.0+

Compatibel tot

6.9.4

Vereist PHP

7.0+