WordPress plugin
Abandoned Cart Lite for WooCommerce security & vulnerabilities
No known unpatched vulnerabilities in the latest version
All 15 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.
- Critical3
- High2
- Medium8
- Low2
All Abandoned Cart Lite for WooCommerce vulnerabilities
| Severity | Vulnerability | CVE | Published |
|---|---|---|---|
| Medium4.4 | Authenticated (Shop manager+) Stored Cross-Site Scripting ≤6.8.0Update to 6.8.1 | CVE-2026-65557 | |
| Medium4.3 | Cross-Site Request Forgery ≤6.8.0Update to 6.8.1 | CVE-2026-57637 | |
| Critical9.8 | Unauthenticated Privilege Escalation via Weak Recovery Link ≤6.8.1Update to 6.8.2 | CVE-2026-12585 | |
| Medium5.3 | Cross-Site Request Forgery ≤5.16.1Update to 5.16.2 | — | |
| Medium5.4 | Missing Authorization via multiple AJAX functions ≤5.16.1Update to 5.16.2 | CVE-2023-41671 | |
| Low3.1 | Improper Authorization via wcal_delete_expired_used_coupon_code <5.16.1Update to 5.16.1 | — | |
| Low3.7 | Improper Authorization via wcal_preview_emails <5.16.1Update to 5.16.1 | — | |
| Medium4.4 | Authenticated (Administrator+) Stored Cross-Site Scripting ≤5.15.2Update to 5.16.0 | CVE-2023-44986 | |
| Critical9.8 | Authentication Bypass ≤5.15.1Update to 5.15.2 | CVE-2023-2986 | |
| Medium4.3 | Cross-Site Request Forgery via delete_expired_used_coupon_code <5.14.2Update to 5.14.2 | — | |
| Medium4.3 | Cross-Site Request Forgery via ts_reset_tracking_setting <5.14.2Update to 5.14.2 | — | |
| Medium4.3 | Cross-Site Request Forgery Bypass ≤5.8.5Update to 5.8.6 | CVE-2021-4414 | |
| Critical9.8 | SQL Injection ≤5.8.2Update to 5.8.3 | — | |
| High7.2 | Stored Cross-Site Scripting <5.2.0Update to 5.2.0 | CVE-2019-25152 | |
| High8.8 | SQL Injection <1.9Update to 1.9 | — |
- Medium4.4Authenticated (Shop manager+) Stored Cross-Site Scripting
≤6.8.0Update to 6.8.1
- Medium4.3Cross-Site Request Forgery
≤6.8.0Update to 6.8.1
- Critical9.8Unauthenticated Privilege Escalation via Weak Recovery Link
≤6.8.1Update to 6.8.2
- Medium5.3Cross-Site Request Forgery
≤5.16.1Update to 5.16.2
- Medium5.4Missing Authorization via multiple AJAX functions
≤5.16.1Update to 5.16.2
- Low3.1Improper Authorization via wcal_delete_expired_used_coupon_code
<5.16.1Update to 5.16.1
- Low3.7Improper Authorization via wcal_preview_emails
<5.16.1Update to 5.16.1
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
≤5.15.2Update to 5.16.0
- Critical9.8Authentication Bypass
≤5.15.1Update to 5.15.2
- Medium4.3Cross-Site Request Forgery via delete_expired_used_coupon_code
<5.14.2Update to 5.14.2
- Medium4.3Cross-Site Request Forgery via ts_reset_tracking_setting
<5.14.2Update to 5.14.2
- Medium4.3Cross-Site Request Forgery Bypass
≤5.8.5Update to 5.8.6
- Critical9.8SQL Injection
≤5.8.2Update to 5.8.3
- High7.2Stored Cross-Site Scripting
<5.2.0Update to 5.2.0
- High8.8SQL Injection
<1.9Update to 1.9
Abandoned Cart Lite for WooCommerce: common questions
Does Abandoned Cart Lite for WooCommerce have known vulnerabilities?
Yes. VulnCrest Radar lists 15 known vulnerabilities in Abandoned Cart Lite for WooCommerce: 3 critical, 2 high, 8 medium, 2 low. None are known to affect version null.
How do I check which version of Abandoned Cart Lite for WooCommerce I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent Abandoned Cart Lite for WooCommerce vulnerability?
CVE-2026-65557, published Jul 24, 2026: Abandoned Cart Lite for WooCommerce <= 6.8.0 - Authenticated (Shop manager+) Stored Cross-Site Scripting. Severity: Medium (CVSS 4.4).
Is any Abandoned Cart Lite for WooCommerce vulnerability listed in CISA KEV?
No. None of the known Abandoned Cart Lite for WooCommerce vulnerabilities is currently listed in the CISA KEV catalog.