Woo Abandoned Cart Recovery Vulnerabilities

The Abandoned Cart Recovery for WooCommerce plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 1.1.12. This makes it possible for unauthenticated attackers to perform an unauthorized action.

CVSS:

5.3

Affected:

up to 1.1.12

Fixed in:

1.1.13

Disclosed:

Jul 8, 2026

CVE-2026-57698 on NVD →

The Abandoned Cart Recovery for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.1.10 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execu...

CVSS:

7.2

Affected:

up to 1.1.10

Fixed in:

1.1.11

Disclosed:

Mar 20, 2026

CVE-2026-32526 on NVD →

The Abandoned Cart Recovery for WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.4. This is due to missing or incorrect nonce validation on the get_items() and extra_tablenav() functions. This makes it possible for unauthenticated attackers to perform re...

CVSS:

4.3

Affected:

up to 1.0.4

Fixed in:

1.0.4.1

Disclosed:

Jul 5, 2021

CVE-2021-4395 on NVD →