Executive brief
RexTheme Cart Lift, a WordPress plugin used to recover abandoned shopping carts, is vulnerable to a security flaw that allows attackers to inject malicious scripts into the website. If an administrator or visitor views a page containing this injected content, the attacker's script could steal session information, redirect users to malicious sites, or perform unauthorized actions on behalf of the user. This could lead to a loss of customer trust and potential compromise of the website's management interface.
Technical details
The RexTheme Cart Lift plugin for WordPress (versions <= 3.1.57) contains a Stored Cross-Site Scripting (XSS) vulnerability due to improper neutralization of user-supplied input during web page generation. An unauthenticated attacker can inject malicious scripts into the application, which are then stored on the server. The vulnerability requires user interaction, typically from a privileged user (like an administrator) viewing the affected page, to execute the payload. Successful exploitation allows the attacker to execute arbitrary JavaScript in the context of the victim's browser, potentially leading to session hijacking or unauthorized administrative actions. The issue is resolved in version 3.1.58.
Affected products
- RexTheme Cart Lift <= 3.1.57
Timeline
- 2026-05-22: disclosed: Reported by dodoh4t to Patchstack
- 2026-07-08: advisory: Patchstack published advisory
- 2026-07-13: advisory: NVD published CVE record
- 2026-07-13: patched: Version 3.1.58 released to address the issue