CVE-2026-123134 · Package
NO FIX YET · SEE WHAT TO DO
The Smoove abandoned cart trigger plugin for WooCommerce does not sanitise abandoned-cart data that visitors submit before showing it in the WordPress admin dashboard. An unauthenticated visitor can store a script that runs in an administrator's browser.
first public Nov 11, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Sites running the Smoove abandoned cart trigger for WooCommerce WordPress plugin before 4.3.6 with WooCommerce cart tracking active. Exposure comes from visitor-submitted cart data being shown in the admin dashboard, so administrators who view that dashboard are the people at risk. Sites without the plugin, or running 4.3.6 or later, are not affected.
Not affected if plugin-not-installed, version-4.3.6-or-later
Who cares self-hosted, smoove, woocommerce, wordpress
wp plugin get smoove-abandoned-cart-trigger-for-woocommerce --field=version if WP-CLI is available4.3.6The Smoove abandoned cart trigger for WooCommerce WordPress plugin before 4.3.6 does not sanitise and escape abandoned-cart data submitted by visitors before outputting it in the admin dashboard, allowing unauthenticated users to perform Stored Cross-Site Scripting attacks against administrators.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.