Description
The Smoove abandoned cart trigger for WooCommerce WordPress plugin before 4.3.6 does not sanitise and escape abandoned-cart data submitted by visitors before outputting it in the admin dashboard, allowing unauthenticated users to perform Stored Cross-Site Scripting attacks against administrators.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Smoove abandoned cart trigger for WooCommerce | 4.0.0 – < 4.3.6 | 4.3.6 |
References
- https://wpscan.com/vulnerability/ad3a49ed-4740-4503-9c08-8c0fac5fc270/ exploit vdb-entry technical-description