cbcvebase.
CVE-2019-25152
published 2023-06-22

CVE-2019-25152: The Abandoned Cart Lite for WooCommerce and Abandoned Cart Pro for WooCommerce plugins for WordPress are vulnerable to Stored Cross-Site Scripting via multiple…

PriorityP180medium6.1CVSS 3.1
AVNACLPRNUIRSCCLILAN
ITWEXPLOITVulnCheck KEV
Exploited in the wild
EPSS
1.35%
68.1th percentile
The Abandoned Cart Lite for WooCommerce and Abandoned Cart Pro for WooCommerce plugins for WordPress are vulnerable to Stored Cross-Site Scripting via multiple parameters in versions up to, and including, 5.1.3 and 7.12.0 respectively, due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in user input that will execute on the admin dashboard.

Affected

3 ranges
VendorProductVersion rangeFixed in
tycheabandoned_cart_pro_for_woocommerce<= 7.12.0—
tychesoftwaresabandoned_cart_lite_for_woocommerce< 5.2.05.2.0
tychesoftwaresabandoned_cart_pro_for_woocommerce<= 7.12.0—

Detection & IOCsextracted from sources · hover to see the quote

path/wp-content/plugins/woocommerce-abandoned-cart/readme.txt↗
path/wp-content/plugins/woocommerce-abandoned-cart/↗
  • →Use regex on readme.txt body to extract plugin version from 'Stable tag' field for version comparison ↗
  • →FOFA/Shodan fingerprint: search for sites serving content containing the plugin path string to identify exposed instances ↗
  • ·Vulnerability affects Abandoned Cart Lite for WooCommerce up to and including version 5.1.3 (fixed in 5.2.0) and Abandoned Cart Pro up to and including 7.12.0; both must be checked separately ↗
  • ·The XSS is stored and triggered on the admin dashboard via unauthenticated user input — no authentication required to inject, but execution requires an admin to view the dashboard ↗

CVSS provenance

nvdv3.16.1MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
vulncheck7.2HIGH
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.