The vulnerability is a stored cross‑site scripting flaw caused by improper input neutralization when generating web pages. An attacker can inject malicious JavaScript that is stored by the Abandoned Cart Recovery for WooCommerce plugin and then executed in a victim’s browser. This may allow data theft, session hijacking, or defacement of the site. The weakness is identified as CWE‑79. The impact is primarily on confidentiality and integrity of users’ session data and on the availability of trusted site functionality.

VillaTheme’s Abandoned Cart Recovery for WooCommerce plugin for WordPress is affected. All releases from the earliest version up through 1.1.10 are vulnerable. Application owners should verify that their site is running any of these versions before applying a fix.

The CVSS score of 7.1 indicates substantial risk; the EPSS score is not available, and the vulnerability is not listed in the KEV catalog. Attackers can exploit the flaw by submitting malicious input via the plugin’s storage mechanism, which is then rendered on pages accessed by site administrators or customers. Exploitation does not require elevated privileges and can be performed remotely through the public interface. Due to the stored nature of the flaw, any injected script remains on the site until removed or overwritten.