Smoove Abandoned Cart Trigger for WooCommerce (< 4.3.6) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/smoove-abandoned-cart-trigger-for-woocommerce--4.3.6/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 11 Nov 2026 14:00:00 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgSmoove abandoned cart trigger for WooCommerce: Stored Cross-Site Scripting (CVE-2026-123134)https://feed.craftedsignal.io/briefs/2026-11-smoove-xss-cve-2026-123134/Wed, 11 Nov 2026 14:00:00 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-smoove-xss-cve-2026-123134/The Smoove abandoned cart trigger for WooCommerce WordPress plugin before 4.3.6 does not sanitise and escape abandoned-cart data, allowing unauthenticated users to perform Stored Cross-Site Scripting attacks.<p>The Smoove abandoned cart trigger for WooCommerce WordPress plugin before 4.3.6 does not sanitise and escape abandoned-cart data submitted by visitors before outputting it in the admin dashboard. This allows unauthenticated users to perform Stored Cross-Site Scripting attacks against administrators.</p> highadvisory