CVE-2019-25152: Abandoned Cart Lite for WooCommerce < 5.2.0 and Abandoned Cart Pro for WooCommerce < 7.13.0 - Stored Cross-Site Scripting
The Abandoned Cart Lite for WooCommerce and Abandoned Cart Pro for WooCommerce plugins for WordPress are vulnerable to Stored Cross-Site Scripting via multiple parameters in versions up to, and including, 5.1.3 and 7.12.0 respectively, due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in user input that will execute on the admin dashboard.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2019-25152?
CVE-2019-25152 is a vulnerability in the Abandoned Cart Lite for WooCommerce and Abandoned Cart Pro for WooCommerce plugins for WordPress, which allows for Stored Cross-Site Scripting (XSS) attacks.
What is the severity of CVE-2019-25152?
The severity of CVE-2019-25152 is high with a severity value of 6.1.
How does CVE-2019-25152 affect the Abandoned Cart Lite for WooCommerce plugin?
CVE-2019-25152 affects the Abandoned Cart Lite for WooCommerce plugin versions up to and including 5.1.3, allowing for Stored Cross-Site Scripting (XSS) attacks due to insufficient input sanitization and output escaping.
How does CVE-2019-25152 affect the Abandoned Cart Pro for WooCommerce plugin?
CVE-2019-25152 affects the Abandoned Cart Pro for WooCommerce plugin versions up to and including 7.12.0, allowing for Stored Cross-Site Scripting (XSS) attacks due to insufficient input sanitization and output escaping.
How can I fix CVE-2019-25152?
To fix CVE-2019-25152, it is recommended to update the Abandoned Cart Lite for WooCommerce plugin to version 5.2.0 or newer, and the Abandoned Cart Pro for WooCommerce plugin to version 7.12.1 or newer, which address the vulnerability by implementing proper input sanitization and output escaping.