CVE-2026-123134
HIGH
NVD
CVSS Score
8.8
Severity
HIGH
Published
Nov 11, 2026
Vendor
unknown
Description
The Smoove abandoned cart trigger for WooCommerce WordPress plugin before 4.3.6 does not sanitise and escape abandoned-cart data submitted by visitors before outputting it in the admin dashboard, allowing unauthenticated users to perform Stored Cross-Site Scripting attacks against administrators.