CVE-2019-25152

The Abandoned Cart Lite for WooCommerce and Abandoned Cart Pro for WooCommerce plugins for WordPress are vulnerable to Stored Cross-Site Scripting via multiple parameters in versions up to, and including, 5.1.3 and 7.12.0 respectively, due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in user input that will execute on the admin dashboard.

• CWE-79

• https://plugins.trac.wordpress.org/changeset/2033212Patch
• https://wpscan.com/vulnerability/9229Third Party Advisory
• https://www.wordfence.com/blog/2019/03/xss-flaw-in-abandoned-cart-plugin-leads-to-wordpress-site-takeovers/Exploit, Third Party Advisory
• https://www.wordfence.com/threat-intel/vulnerabilities/id/a9cc5c6d-4396-4ebf-8788-f01dd9e9cfbc?source=cveThird Party Advisory
• https://plugins.trac.wordpress.org/changeset/2033212Patch
• https://wpscan.com/vulnerability/9229Third Party Advisory
• https://www.wordfence.com/blog/2019/03/xss-flaw-in-abandoned-cart-plugin-leads-to-wordpress-site-takeovers/Exploit, Third Party Advisory
• https://www.wordfence.com/threat-intel/vulnerabilities/id/a9cc5c6d-4396-4ebf-8788-f01dd9e9cfbc?source=cveThird Party Advisory

Published

Jun 22, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-25146The DELUCKS SEO plugin for WordPress is vulnerable to Stored…6.1
• CVE-2019-25147The Pretty Links plugin for WordPress is vulnerable to Store…6.1
• CVE-2019-25148The WP HTML Mail plugin for WordPress is vulnerable to HTML …6.1
• CVE-2019-25149The Gallery Images Ape plugin for WordPress is vulnerable to…4.3
• CVE-2019-25150The Email Templates plugin for WordPress is vulnerable to HT…8.8
• CVE-2019-25151The Funnel Builder plugin for WordPress is vulnerable to aut…4.3
• CVE-2019-25154Inappropriate implementation in iframe in Google Chrome prio…9.6
• CVE-2019-25155DOMPurify before 1.0.11 allows reverse tabnabbing in demos/h…6.1
• CVE-2019-25156A vulnerability classified as problematic was found in dstar…6.1
• CVE-2019-25157A vulnerability was found in Ethex Contracts. It has been cl…4.3
• CVE-2019-25158A vulnerability has been found in pedroetb tts-api up to 2.1…9.8
• CVE-2019-25159A vulnerability was found in mpedraza2020 Intranet del Monte…9.8