CVE-2026-123134: Smoove Abandoned Cart Trigger for WooCommerce 4.0.0 - 4.3.5 - Unauthenticated Stored XSS
Published Nov 11, 2026
·Updated
The Smoove abandoned cart trigger for WooCommerce WordPress plugin before 4.3.6 does not sanitise and escape abandoned-cart data submitted by visitors before outputting it in the admin dashboard, allowing unauthenticated users to perform Stored Cross-Site Scripting attacks against administrators.
Affected Software
1 affected component
Smoove Abandoned Cart Trigger for WooCommerce<4.3.6
Event History
Nov 11, 2026
CVE Published
via MITRE·06:00 AM
Data Sourced
via MITRE·06:00 AM
DescriptionWeakness
Data Sourced
via NVD·06:17 AM
Description
Frequently Asked Questions
1
Who can exploit this issue, and who is affected by the resulting script execution?
An unauthenticated visitor can submit crafted abandoned-cart data. The stored script executes when an administrator views the affected data in the WordPress admin dashboard.
2
Which plugin versions are affected?
Versions before 4.3.6 are affected, including 4.0.0 through 4.3.5.
3
Does exploitation require a visitor account or prior access to WordPress?
No. The issue is described as unauthenticated, so an attacker does not need a WordPress account before submitting the malicious abandoned-cart data.