CVE-2026-123134: high-severity vulnerability in Smoove abandoned cart trigger for WooCommerce
Smoove Abandoned Cart Trigger for WooCommerce 4.0.0 - 4.3.5 - Unauthenticated Stored XSS
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
18Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 8.8
The Smoove abandoned cart trigger for WooCommerce WordPress plugin before 4.3.6 does not sanitise and escape abandoned-cart data submitted by visitors before outputting it in the admin dashboard, allowing unauthenticated users to perform Stored Cross-Site Scripting attacks against administrators.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected products
Unknown · Smoove abandoned cart trigger for WooCommerce