{"id":"CVE-2026-123134","kind":"vulnerability","aliases":["CVE-2026-123134"],"related":[],"title":"Smoove WooCommerce plugin: unauthenticated visitors can plant scripts in admin dashboard","description":"The Smoove abandoned cart trigger for WooCommerce WordPress plugin before 4.3.6 does not sanitise and escape abandoned-cart data submitted by visitors before outputting it in the admin dashboard, allowing unauthenticated users to perform Stored Cross-Site Scripting attacks against administrators.","summary":"The Smoove abandoned cart trigger plugin for WooCommerce does not sanitise abandoned-cart data that visitors submit before showing it in the WordPress admin dashboard. An unauthenticated visitor can store a script that runs in an administrator's browser.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","smoove","woocommerce","wordpress"],"not_affected_if":["plugin-not-installed","version-4.3.6-or-later"],"how_to_check":"- Check the installed version of the Smoove abandoned cart trigger for WooCommerce plugin in the WordPress admin plugin list, or with `wp plugin get smoove-abandoned-cart-trigger-for-woocommerce --field=version` if WP-CLI is available\n- Confirm whether the plugin is active on the site","fix":"- Smoove abandoned cart trigger for WooCommerce WordPress plugin: `4.3.6`","status":"open","published_at":"2026-11-11T06:17:17+00:00","first_seen_at":"2026-11-11T06:25:42+00:00","triaged_at":"2026-11-11T06:27:24+00:00","updated_at":"2026-11-11T06:27:24+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-11T06:27:24Z","model":"claude-haiku-5-5","output":{"fix":"- Smoove abandoned cart trigger for WooCommerce WordPress plugin: `4.3.6`","reach":"internet","title":"Smoove WooCommerce plugin: unauthenticated visitors can plant scripts in admin dashboard","impact":"medium","summary":"The Smoove abandoned cart trigger plugin for WooCommerce does not sanitise abandoned-cart data that visitors submit before showing it in the WordPress admin dashboard. An unauthenticated visitor can store a script that runs in an administrator's browser.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","woocommerce","smoove","self-hosted"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"Script runs in administrator browsers, enabling session or admin account takeover","analyst_note":"","how_to_check":"- Check the installed version of the Smoove abandoned cart trigger for WooCommerce plugin in the WordPress admin plugin list, or with `wp plugin get smoove-abandoned-cart-trigger-for-woocommerce --field=version` if WP-CLI is available\n- Confirm whether the plugin is active on the site","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["plugin-not-installed","version-4.3.6-or-later"],"who_is_affected":"Sites running the Smoove abandoned cart trigger for WooCommerce WordPress plugin before 4.3.6 with WooCommerce cart tracking active. Exposure comes from visitor-submitted cart data being shown in the admin dashboard, so administrators who view that dashboard are the people at risk. Sites without the plugin, or running 4.3.6 or later, are not affected.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000777,"input_tokens":4562,"output_tokens":642,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-123134':14A,17A '-2026':13A,16A '4.3.6':75C 'abandon':27B,37B,67C,82C 'abandoned-cart':36B,81C 'admin':10A,49B,93C 'administr':62B,107C 'allow':95C 'attack':105C 'browser':64B 'cart':28B,38B,68C,83C 'cross':102C 'cross-sit':101C 'cve':12A,15A 'dashboard':11A,50B,94C 'data':39B,84C 'escap':80C 'host':21B 'output':89C 'packag':18B 'perform':99C 'plant':7A 'plugin':3A,30B,73C 'run':59B 'sanitis':35B,78C 'script':8A,57B,104C 'self':20B 'self-host':19B 'show':44B 'site':103C 'smoov':1A,22B,26B,66C 'store':55B,100C 'submit':42B,85C 'trigger':29B,69C 'unauthent':4A,52B,96C 'user':97C 'visitor':5A,41B,53B,87C 'woocommerc':2A,23B,32B,71C 'wordpress':24B,48B,72C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Smoove abandoned cart trigger for WooCommerce WordPress plugin before 4.3.6 with WooCommerce cart tracking active. Exposure comes from visitor-submitted cart data being shown in the admin dashboard, so administrators who view that dashboard are the people at risk. Sites without the plugin, or running 4.3.6 or later, are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","package","selfhosted","smoove","woocommerce","wordpress"],"campaign_type":null,"search_a":"'-123134':14A,17A '-2026':13A,16A 'admin':10A 'cve':12A,15A 'dashboard':11A 'plant':7A 'plugin':3A 'script':8A 'smoov':1A 'unauthent':4A 'visitor':5A 'woocommerc':2A","search_b":"'abandon':27B,37B 'abandoned-cart':36B 'admin':49B 'administr':62B 'browser':64B 'cart':28B,38B 'dashboard':50B 'data':39B 'host':21B 'packag':18B 'plugin':30B 'run':59B 'sanitis':35B 'script':57B 'self':20B 'self-host':19B 'show':44B 'smoov':22B,26B 'store':55B 'submit':42B 'trigger':29B 'unauthent':52B 'visitor':41B,53B 'woocommerc':23B,32B 'wordpress':24B,48B","search_c":"'4.3.6':75C 'abandon':67C,82C 'abandoned-cart':81C 'admin':93C 'administr':107C 'allow':95C 'attack':105C 'cart':68C,83C 'cross':102C 'cross-sit':101C 'dashboard':94C 'data':84C 'escap':80C 'output':89C 'perform':99C 'plugin':73C 'sanitis':78C 'script':104C 'site':103C 'smoov':66C 'store':100C 'submit':85C 'trigger':69C 'unauthent':96C 'user':97C 'visitor':87C 'woocommerc':71C 'wordpress':72C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T06:17:17+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123134","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123134","severity":null,"published_at":"2026-11-11T06:17:17+00:00","modified_at":"2026-11-11T06:17:17+00:00","first_seen_at":"2026-11-11T06:25:42+00:00","fetched_at":"2026-11-11T06:25:42+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}