PT-2026-28040 · Automattic+1 · Woocommerce+1

Published 2026-03-25 · Updated 2026-04-08 · CVE-2026-32526

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions VillaTheme Abandoned Cart Recovery for WooCommerce versions through 1.1.10

Description The software contains an Improper Neutralization of Input During Web Page Generation issue, specifically a Cross-site Scripting condition. This allows for Stored XSS attacks. The vulnerability exists due to insufficient input sanitization during web page generation. The affected component is Abandoned Cart Recovery for WooCommerce.

Recommendations Update VillaTheme Abandoned Cart Recovery for WooCommerce to a version later than 1.1.10.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-32526

Affected Products

Abandoned Cart Recovery For Woocommerce

Woocommerce

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-32526 · Security Note
• https://twitter.com/atomicedgeWAF/status/2041916499451937130 · Twitter Post
• https://patchstack.com/database/Wordpress/Plugin/woo-abandoned-cart-recovery/vulnerability/wordpress-abandoned-cart-recovery-for-woocommerce-plugin-1-1-10-cross-site-scripting-xss-vulnerability?_s_id=cve · Note
• https://twitter.com/CVEnew/status/2036911877671027178 · Twitter Post
• https://twitter.com/infoflowcloud/status/2036912638416871600 · Twitter Post