CVE-2019-25152

HIGH EXPLOITED NUCLEI

Abandoned Cart Lite/WooCommerce <5.1.3 & Abandoned Cart Pro/WooComm...

Title source: llm
STIX 2.1

Exploitation Summary

CVE-2019-25152 has been observed exploited in the wild (reported by VulnCheck KEV). A Nuclei detection template is also available.

Description

The Abandoned Cart Lite for WooCommerce and Abandoned Cart Pro for WooCommerce plugins for WordPress are vulnerable to Stored Cross-Site Scripting via multiple parameters in versions up to, and including, 5.1.3 and 7.12.0 respectively, due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in user input that will execute on the admin dashboard.

Nuclei Templates (1)

Abandoned Cart Lite for WooCommerce < 5.2.0 - Cross-Site Scripting
HIGHVERIFIEDby DhiyaneshDK
Shodan: http.html:"/wp-content/plugins/woocommerce-abandoned-cart/"
FOFA: body="/wp-content/plugins/woocommerce-abandoned-cart/"

References (4)

Core 4

Scores

CVSS v3 7.2
EPSS 0.0134
EPSS Percentile 67.6%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

VulnCheck KEV 2019-03-11
CWE
CWE-79
Status published
Products (4)
TYCHE/Abandoned Cart Pro for WooCommerce < 7.12.0
tychesoftwares/Abandoned Cart Lite for WooCommerce < 5.2.0
tychesoftwares/abandoned_cart_lite_for_woocommerce < 5.2.0
tychesoftwares/abandoned_cart_pro_for_woocommerce < 7.12.0
Published Jun 22, 2023
Tracked Since Feb 18, 2026