tychesoftwares Vulnerabilities and Affected Products
Vulnerabilities associated with Abandoned Cart Lite for WooCommerce.
Products
Clear product- Arconix Shortcodes8 vulnerabilities
- Print Invoice & Delivery Notes for WooCommerce7 vulnerabilities
- Abandoned Cart Lite for WooCommerce6 vulnerabilities
- Order Delivery Date for WooCommerce4 vulnerabilities
- Product Delivery Date for WooCommerce – Lite3 vulnerabilities
- Product Input Fields for WooCommerce3 vulnerabilities
- abandoned_cart_lite_for_woocommerce2 vulnerabilities
- Arconix FAQ2 vulnerabilities
- acronix_faq1 vulnerability
- arconix_shortcodes1 vulnerability
- booking_and_appointment_plugin_for_woo_commerce1 vulnerability
- Call for Price for WooCommerce1 vulnerability
- Custom Order Numbers for WooCommerce1 vulnerability
- Order Delivery Date for WP e-Commerce1 vulnerability
- order_delivery_date_for_woocommerce1 vulnerability
- Payment Gateway Based Fees and Discounts for WooCommerce1 vulnerability
- product_delivery_date_for_woocommerce_lite1 vulnerability
- product_input_fields_for_woocommerce1 vulnerability
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
CVE-2026-65557MEDIUM | WordPress Abandoned Cart Lite for WooCommerce plugin <= 6.8.0 - Cross Site Scripting (XSS) vulnerabilityShop manager Cross Site Scripting (XSS) in Abandoned Cart Lite for WooCommerce <= 6.8.0 versions. CWE-79Jul 27, 2026 | CVSS5.9v3.1 | EPSS0.14% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-57637MEDIUM | WordPress Abandoned Cart Lite for WooCommerce plugin <= 6.8.0 - Cross Site Request Forgery (CSRF) vulnerabilityUnauthenticated Cross Site Request Forgery (CSRF) in Abandoned Cart Lite for WooCommerce <= 6.8.0 versions. CWE-352Jun 26, 2026 | CVSS4.3v3.1 | EPSS0.104% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2023-41671MEDIUM | WordPress Abandoned Cart Lite for WooCommerce plugin <= 5.16.1 - Cross Site Request Forgery (CSRF) vulnerabilityMissing Authorization vulnerability in tychesoftwares Abandoned Cart Lite for WooCommerce woocommerce-abandoned-cart allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Abandoned Cart Lite for WooCommerce: from n/a through <= 5.16.1. CWE-862Dec 13, 2024 | CVSS5.4v3.1 | EPSS0.457% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2021-4414MEDIUM | Abandoned Cart Lite for WooCommerce <= 5.8.5 - Cross-Site Request Forgery BypassThe Abandoned Cart Lite for WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.8.5. This is due to missing or incorrect nonce validation on the wcal_preview_emails() function. This makes it possible for unauthenticated attackers to generate email preview templates via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. CWE-352Jul 12, 2023 | CVSS4.3v3.1 | EPSS0.388% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2019-25152HIGH | Abandoned Cart Lite for WooCommerce < 5.2.0 and Abandoned Cart Pro for WooCommerce < 7.13.0 - Stored Cross-Site ScriptingThe Abandoned Cart Lite for WooCommerce and Abandoned Cart Pro for WooCommerce plugins for WordPress are vulnerable to Stored Cross-Site Scripting via multiple parameters in versions up to, and including, 5.1.3 and 7.12.0 respectively, due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in user input that will execute on the admin dashboard. | CVSS7.2v3.1 | EPSS1.36% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware use1 Nuclei template | STIX |
CVE-2023-2986CRITICAL | Abandoned Cart Lite for WooCommerce <= 5.15.1 - Authentication BypassThe Abandoned Cart Lite for WooCommerce plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 5.14.2. This is due to insufficient encryption on the user being supplied during the abandoned cart link decode through the plugin. This allows unauthenticated attackers to log in as users who have abandoned the cart, who are typically customers. Further security hardening was introduced in version 5.15.1 that ensures sites are no longer vulnerable through histori… | CVSS9.8v3.1 | EPSS42.8% | PoCs2 | SignalsNot listed in CISA KEVNo known ransomware use1 Nuclei template | STIX |