Plugin security history

Abandoned Cart Lite for WooCommerce Vulnerability History & Security Timeline

The Wordfence Intelligence dataset currently contains 15 vulnerability records associated with Abandoned Cart Lite for WooCommerce, published between 2015 and 2026.

Dataset last synchronized: 2026-08-03 00:31:25 UTC

At a glance

Security Snapshot

15Total records

3Critical

2High

8Medium

2Low

0Informational

15Patched records

0Currently marked unpatched

2015-07-15First disclosure

2026-07-24Latest disclosure

8 of 15CVE coverage

Year-by-Year Timeline

Year	Records	Relative volume
2015	1	1 records
2019	1	1 records
2020	1	1 records
2021	1	1 records
2023	8	8 records
2026	3	3 records

Severity Breakdown

Severity	Records	Share
Critical	3	20%
High	2	13.3%
Medium	8	53.3%
Low	2	13.3%

Vulnerability-Type Breakdown

CSRF

5 records33.3%

First: 2021. Latest: 2026.

Cross-Site Scripting

3 records20%

First: 2019. Latest: 2026.

Missing Authorization

3 records20%

First: 2023. Latest: 2023.

SQL Injection

2 records13.3%

First: 2015. Latest: 2020.

Authentication Bypass

2 records13.3%

First: 2023. Latest: 2026.

Patch Status

Patched: 15
Currently marked unpatched: 0
Unknown status: 0

Patch status reflects the latest successfully synchronized source dataset and must be checked against the installed version.

Latest Known Patched Versions

6.8.1
6.8.2
5.16.2
5.16.1
5.16.0
5.15.2
5.14.2
5.8.6
5.8.3
5.2.0
1.9

Affected-Version History

Ranges are deduplicated by source range record and shown with the associated disclosure and known patched versions.

Affected range	Vulnerability	Published	Patched version	Severity
`*-6.8.0`	Abandoned Cart Lite for WooCommerce <= 6.8.0 - Authenticated (Shop manager+) Stored Cross-Site Scripting	July 24, 2026	6.8.1	Medium
`*-6.8.0`	Abandoned Cart Lite for WooCommerce <= 6.8.0 - Cross-Site Request Forgery	June 26, 2026	6.8.1	Medium
`*-6.8.1`	Abandoned Cart Lite for WooCommerce <= 6.8.1 - Unauthenticated Privilege Escalation via Weak Recovery Link	June 25, 2026	6.8.2	Critical
`*-5.16.1`	Abandoned Cart Lite for WooCommerce <= 5.16.1 - Cross-Site Request Forgery	December 1, 2023	5.16.2	Medium
`*-5.16.1`	Abandoned Cart Lite for WooCommerce <= 5.16.1 - Missing Authorization via multiple AJAX functions	November 28, 2023	5.16.2	Medium
`[*, 5.16.1)`	Abandoned Cart Lite for WooCommerce <= 5.16.0 - Improper Authorization via wcal_delete_expired_used_coupon_code	November 21, 2023	5.16.1	Low
`[*, 5.16.1)`	Abandoned Cart Lite for WooCommerce <= 5.16.0 - Improper Authorization via wcal_preview_emails	November 21, 2023	5.16.1	Low
`*-5.15.2`	Abandoned Cart Lite for WooCommerce <= 5.15.2 - Authenticated (Administrator+) Stored Cross-Site Scripting	October 2, 2023	5.16.0	Medium
`*-5.15.1`	Abandoned Cart Lite for WooCommerce <= 5.15.1 - Authentication Bypass	June 6, 2023	5.15.2	Critical
`[*, 5.14.2)`	Abandoned Cart Lite for WooCommerce <= 5.14.1 - Cross-Site Request Forgery via ts_reset_tracking_setting	May 22, 2023	5.14.2	Medium
`[*, 5.14.2)`	Abandoned Cart Lite for WooCommerce <= 5.14.1 - Cross-Site Request Forgery via delete_expired_used_coupon_code	May 22, 2023	5.14.2	Medium
`*-5.8.5`	Abandoned Cart Lite for WooCommerce <= 5.8.5 - Cross-Site Request Forgery Bypass	March 1, 2021	5.8.6	Medium
`*-5.8.2`	Abandoned Cart Lite for WooCommerce <= 5.8.2 - SQL Injection	November 8, 2020	5.8.3	Critical
`[*, 5.2.0)`	Abandoned Cart Lite for WooCommerce < 5.2.0 and Abandoned Cart Pro for WooCommerce < 7.13.0 - Stored Cross-Site Scripting	March 11, 2019	5.2.0	High
`[*, 1.9)`	Abandoned Cart Lite for WooCommerce < 1.9 - SQL Injection	July 15, 2015	1.9	High

Selected source records

Latest Records

MediumCVE-2026-65557

Abandoned Cart Lite for WooCommerce <= 6.8.0 - Authenticated (Shop manager+) Stored Cross-Site Scripting

Published: July 24, 2026

Affected versions: *-6.8.0
Patched versions: 6.8.1

Original Wordfence record

MediumCVE-2026-57637

Abandoned Cart Lite for WooCommerce <= 6.8.0 - Cross-Site Request Forgery

Published: June 26, 2026

Affected versions: *-6.8.0
Patched versions: 6.8.1

Original Wordfence record

CriticalCVE-2026-12585

Abandoned Cart Lite for WooCommerce <= 6.8.1 - Unauthenticated Privilege Escalation via Weak Recovery Link

Published: June 25, 2026

Affected versions: *-6.8.1
Patched versions: 6.8.2

Original Wordfence record

Medium

Abandoned Cart Lite for WooCommerce <= 5.16.1 - Cross-Site Request Forgery

Published: December 1, 2023

Affected versions: *-5.16.1
Patched versions: 5.16.2

Original Wordfence record

MediumCVE-2023-41671

Abandoned Cart Lite for WooCommerce <= 5.16.1 - Missing Authorization via multiple AJAX functions

Published: November 28, 2023

Affected versions: *-5.16.1
Patched versions: 5.16.2

Original Wordfence record

Low

Abandoned Cart Lite for WooCommerce <= 5.16.0 - Improper Authorization via wcal_preview_emails

Published: November 21, 2023

Affected versions: [*, 5.16.1)
Patched versions: 5.16.1

Original Wordfence record

Low

Abandoned Cart Lite for WooCommerce <= 5.16.0 - Improper Authorization via wcal_delete_expired_used_coupon_code

Published: November 21, 2023

Affected versions: [*, 5.16.1)
Patched versions: 5.16.1

Original Wordfence record

MediumCVE-2023-44986

Abandoned Cart Lite for WooCommerce <= 5.15.2 - Authenticated (Administrator+) Stored Cross-Site Scripting

Published: October 2, 2023

Affected versions: *-5.15.2
Patched versions: 5.16.0

Original Wordfence record

Highest-Severity Records

Critical

Abandoned Cart Lite for WooCommerce <= 5.8.2 - SQL Injection

Published: November 8, 2020

Affected versions: *-5.8.2
Patched versions: 5.8.3

Original Wordfence record

CriticalCVE-2023-2986

Abandoned Cart Lite for WooCommerce <= 5.15.1 - Authentication Bypass

Published: June 6, 2023

Affected versions: *-5.15.1
Patched versions: 5.15.2

Original Wordfence record

CriticalCVE-2026-12585

Abandoned Cart Lite for WooCommerce <= 6.8.1 - Unauthenticated Privilege Escalation via Weak Recovery Link

Published: June 25, 2026

Affected versions: *-6.8.1
Patched versions: 6.8.2

Original Wordfence record

High

Abandoned Cart Lite for WooCommerce < 1.9 - SQL Injection

Published: July 15, 2015

Affected versions: [*, 1.9)
Patched versions: 1.9

Original Wordfence record

HighCVE-2019-25152

Abandoned Cart Lite for WooCommerce < 5.2.0 and Abandoned Cart Pro for WooCommerce < 7.13.0 - Stored Cross-Site Scripting

Published: March 11, 2019

Affected versions: *-7.12.0
Patched versions: 7.13.0

Affected versions: [*, 5.2.0)
Patched versions: 5.2.0

Original Wordfence record

MediumCVE-2023-41671

Abandoned Cart Lite for WooCommerce <= 5.16.1 - Missing Authorization via multiple AJAX functions

Published: November 28, 2023

Affected versions: *-5.16.1
Patched versions: 5.16.2

Original Wordfence record

Medium

Abandoned Cart Lite for WooCommerce <= 5.16.1 - Cross-Site Request Forgery

Published: December 1, 2023

Affected versions: *-5.16.1
Patched versions: 5.16.2

Original Wordfence record

MediumCVE-2026-65557

Abandoned Cart Lite for WooCommerce <= 6.8.0 - Authenticated (Shop manager+) Stored Cross-Site Scripting

Published: July 24, 2026

Affected versions: *-6.8.0
Patched versions: 6.8.1

Original Wordfence record

View all associated vulnerabilities

Need help reviewing an exposed WordPress website?

Running an affected version does not prove that a website was compromised. Suspicious redirects, unknown administrators, injected content, unexpected files or recurring malware may require a manual investigation.

WordPress Malware Removal WordPress Security Maintenance Contact 3Zero Digital

Vulnerability data: Wordfence Intelligence. Analysis and practical guidance: 3Zero Digital.

Data Source, Attribution and Methodology

This page aggregates active Production Feed records. Counts are not software-quality rankings, and an affected version does not prove exploitation or infection. Read the full methodology.

Return to the Security History Directory