Cross-site scripting in tychesoftwares Abandoned Cart Lite for WooCommerce
Priority LOW 34CWE-79Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-79.
Summary
The Abandoned Cart Lite for WooCommerce and Abandoned Cart Pro for WooCommerce plugins for WordPress are vulnerable to Stored Cross-Site Scripting via multiple parameters in versions up to, and including, 5.1.3 and 7.12.0 respectively, due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in user input that will execute on the admin dashboard.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01353 71st percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed Abandoned Cart Lite for WooCommerce (tychesoftwares): 5.2.0
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| tychesoftwares | Abandoned Cart Lite for WooCommerce | before 5.2.0 | 5.2.0 | Patch available | CNA |
| TYCHE | Abandoned Cart Pro for WooCommerce | up to 7.12.0 | — | No fix listed | CNA |
- Abandoned Cart Lite for WooCommerce Vendortychesoftwares Affected before 5.2.0 Fixed in 5.2.0 Patch available CNA
- Abandoned Cart Pro for WooCommerce VendorTYCHE Affected up to 7.12.0 Fixed in — No fix listed CNA
CPE configurations NVD · 2
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:tychesoftwares:abandoned_cart_lite_for_woocommerce:*:*:*:*:*:wordpress:*:* | before 5.2.0 | Vulnerable | tychesoftwares |
| cpe:2.3:a:tychesoftwares:abandoned_cart_pro_for_woocommerce:*:*:*:*:*:wordpress:*:* | up to 7.12.0 | Vulnerable | tychesoftwares |
- cpe:2.3:a:tychesoftwares:abandoned_cart_lite_for_woocommerce:*:*:*:*:*:wordpress:*:* Versions before 5.2.0 Vulnerable ·tychesoftwares
- cpe:2.3:a:tychesoftwares:abandoned_cart_pro_for_woocommerce:*:*:*:*:*:wordpress:*:* Versions up to 7.12.0 Vulnerable ·tychesoftwares
Remediation
- Fix · CNA Abandoned Cart Lite for WooCommerce (tychesoftwares) Fixed in 5.2.0
Timeline
- 2026-10-02 Threatist record created from CVE-2019-25152
- 2026-10-03 Alias added: GHSA-pp7h-37gh-6jqq
References
More tychesoftwares Abandoned Cart Lite For Woocommerce vulnerabilities
- TI-2023-02798 Abandoned Cart Lite for WooCommerce <= 5.15.1 - Authentication Bypass CVSS 3.1CRITICAL 9.8
- TI-2023-24048 WordPress Abandoned Cart Lite for WooCommerce Plugin <= 5.15.2 is vulnerable to Cross Site Scripting (XSS) CVSS 3.1MEDIUM 5.9
- TI-2021-03271 Abandoned Cart Lite for WooCommerce <= 5.8.5 - Cross-Site Request Forgery Bypass CVSS 3.1MEDIUM 4.3
Sources
- CVE-2019-25152 · CVE Program
- CVE-2019-25152 · NVD
- FIRST EPSS
- GHSA-pp7h-37gh-6jqq · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences