PlatformPlansPartners
Resources
ToolsBlogDocs
Labs
CVE ForecastOpservantAll Research →
Sign Up →
high·Product Based Web Vulnerabilities·Updated Oct 7, 2025

Abandoned Cart Lite for WooCommerce < 5.2.0 - Cross-Site Scripting

Est. Time~10 seconds
Scan TypeGroup Scan
Targetsdomain, subdomain, ipv4
CostFree
2.5k
Times Used
continuous scan runs
0
Continuously Checked
assets under CS
0
Vulnerabilities Found
confirmed findings
References
CVECVE-2019-25152
7.2
CVSShigh
Exploitable remotely over the internet · no authentication required.

The Abandoned Cart Lite for WooCommerce and Abandoned Cart Pro for WooCommerce plugins for WordPress are vulnerable to Stored Cross-Site Scripting via multiple parameters in versions up to, and including, 5.1.3 and 7.12.0 respectively, due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in user input that will execute on the admin dashboard.

Attack Vector
Network
Privileges Req.
None
User Interaction
None
Affected
Abandoned Cart Lite for WooCommerceby tychesoftwares
AFFECTED< 5.2.0→SAFE ✓≥ 5.2.0
Abandoned Cart Pro for WooCommerceby TYCHE
0
Updated Sep 9, 2026View on NVD →
Similar Tools
critical
wpDiscuz <= 5.3.5 - SQL Injection
→critical
Progress ADC LoadMaster - Command Injection
→critical
Dahua ICC Intelligent IOT Comprehensive Management Platform Remote Code Execution Scanner
→high
Joomla com_jobprofile SQL Injection Scanner
→critical
CVE-2022-40619 Scanner
→critical
Flowise < 3.1.2 - node-custom-function Unauthorized RCE
→medium
Giga Messenger WordPress - Cross-Site Scripting
→critical
Microsoft Exchange - Pre-Auth SSRF / ACL Bypass (ProxyNotFound)
→

Check your infrastructure.
Right now.

11,000+ scanners. Free to start. No credit card required.

Abandoned Cart Lite for WooCommerce < 5.2.0 - Cross-Site Scripting CVE-2019-25152 Scanner | S4E