CVE-2026-57417

WordPress Cart Lift plugin <= 3.1.57 - Cross Site Scripting (XSS) vulnerability

Published Jul 13, 2026 CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Description

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RexTheme Cart Lift cart-lift allows Stored XSS.This issue affects Cart Lift: from n/a through <= 3.1.57.

Analysis

Technical impact

The Cart Lift plugin contains a Stored XSS flaw due to failure to escape user‑supplied input in generated web pages; attackers can inject malicious scripts that execute in visitors’ browsers.

Affected Systems

The vulnerability impacts RexTheme Cart Lift installations for WordPress up to version 3.1.57; any site running this or earlier releases is exposed.

Risk and Exploitability

The CVSS score of 7.1 signals high severity, while an EPSS score of less than 1% indicates a low probability of exploitation, and the flaw is not listed in CISA KEV. Nonetheless, the stored nature of the XSS means that an attacker who can add or modify content via the plugin can execute arbitrary scripts in users’ browsers; the attack vector is inferred to be through the plugin’s input handling.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

RexTheme

Cart Lift

unaffected

Version	Status	Constraints
`0`	affected	≤ 3.1.57

No data.

Vendor Product Versions

Rextheme

Cart Lift

Version	Status	Scheme	Platform
`[0,3.1.57]`	affected	semver	—
`3.1.58`	unaffected	semver	—

Wordpress

Version	Status	Scheme	Platform
`—`	unaffected	—	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade Cart Lift to a release newer than 3.1.57 that addresses the stored XSS flaw.
Restrict access to the plugin’s content modification features to authenticated administrators only.
Deploy a content‑security‑policy that disallows inline script execution to mitigate exploit risk.

Generated by OpenCVE AI on July 31, 2026 at 11:51 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.251% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://patchstack.com/database/Wordpress/Plugin/cart-lift/vulnerability/wordpress-cart-lift-plugin-3-1-57-cross-site-scripting-xss-vulnerability?_s_id=cve

History

Jul 13, 2026 4:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Jul 13, 2026 3:00 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Rextheme Rextheme cart Lift Wordpress Wordpress wordpress
Vendors & Products		Rextheme Rextheme cart Lift Wordpress Wordpress wordpress

Jul 13, 2026 10:00 AM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RexTheme Cart Lift cart-lift allows Stored XSS.This issue affects Cart Lift: from n/a through <= 3.1.57.
Title		WordPress Cart Lift plugin <= 3.1.57 - Cross Site Scripting (XSS) vulnerability
Weaknesses		CWE-79
References		https://patchstack.com/database/Wordpress/Plugin/cart-lift/vulnerability/wordpress-cart-lift-plugin-3-1-57-cross-site-scripting-xss-vulnerability?_s_id=cve
Metrics		cvssV3_1 `{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L'}`