Smoove abandoned cart trigger for WooCommerce: Stored Cross-Site Scripting (CVE-2026-123134)
The Smoove abandoned cart trigger for WooCommerce WordPress plugin before 4.3.6 does not sanitise and escape abandoned-cart data, allowing unauthenticated users to perform Stored Cross-Site Scripting attacks.
CVE search metadata
CVE search record: CVE-2026-123134. Severity: high. CVSS: 8.8. KEV: no. Product: Smoove abandoned cart trigger for WooCommerce (< 4.3.6). Brief: Smoove abandoned cart trigger for WooCommerce: Stored Cross-Site Scripting (CVE-2026-123134). Brief link: https://feed.craftedsignal.io/briefs/2026-11-smoove-xss-cve-2026-123134/
Triage facts
Revision 1- Applicability
- Smoove abandoned cart trigger for WooCommerce (< 4.3.6)
- Evidence
- Unknown
- Severity
- High
- Sources
- 1 public source
- Freshness
- Revision 1Nov 11, 14:00 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
The Smoove abandoned cart trigger for WooCommerce WordPress plugin before 4.3.6 does not sanitise and escape abandoned-cart data submitted by visitors before outputting it in the admin dashboard. This allows unauthenticated users to perform Stored Cross-Site Scripting attacks against administrators.