WordPress plugin
Abandoned Cart Lite for WooCommerce security & vulnerabilities
No known unpatched vulnerabilities in the latest version
All 15 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.
- Critical3
- High2
- Medium8
- Low2
All Abandoned Cart Lite for WooCommerce vulnerabilities
| Severity | Vulnerability | CVE | Published |
|---|---|---|---|
| Critical9.8 | Unauthenticated Privilege Escalation via Weak Recovery Link ≤6.8.1Update to 6.8.2 | CVE-2026-12585 | |
| Critical9.8 | Authentication Bypass ≤5.15.1Update to 5.15.2 | CVE-2023-2986 | |
| Critical9.8 | SQL Injection ≤5.8.2Update to 5.8.3 | — | |
| High7.2 | Stored Cross-Site Scripting <5.2.0Update to 5.2.0 | CVE-2019-25152 | |
| High8.8 | SQL Injection <1.9Update to 1.9 | — |
- Critical9.8Unauthenticated Privilege Escalation via Weak Recovery Link
≤6.8.1Update to 6.8.2
- Critical9.8Authentication Bypass
≤5.15.1Update to 5.15.2
- Critical9.8SQL Injection
≤5.8.2Update to 5.8.3
- High7.2Stored Cross-Site Scripting
<5.2.0Update to 5.2.0
- High8.8SQL Injection
<1.9Update to 1.9
Abandoned Cart Lite for WooCommerce: common questions
Does Abandoned Cart Lite for WooCommerce have known vulnerabilities?
Yes. VulnCrest Radar lists 15 known vulnerabilities in Abandoned Cart Lite for WooCommerce: 3 critical, 2 high, 8 medium, 2 low. None are known to affect version null.
How do I check which version of Abandoned Cart Lite for WooCommerce I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent Abandoned Cart Lite for WooCommerce vulnerability?
CVE-2026-65557, published Jul 24, 2026: Abandoned Cart Lite for WooCommerce <= 6.8.0 - Authenticated (Shop manager+) Stored Cross-Site Scripting. Severity: Medium (CVSS 4.4).
Is any Abandoned Cart Lite for WooCommerce vulnerability listed in CISA KEV?
No. None of the known Abandoned Cart Lite for WooCommerce vulnerabilities is currently listed in the CISA KEV catalog.