Product
The Smoove abandoned cart trigger for WooCommerce WordPress plugin before 4.3.6 does not sanitise and escape abandoned-cart data, allowing unauthenticated users to perform Stored Cross-Site Scripting attacks.