CVE-2026-65557 is a CWE-79 Cross-Site Scripting (XSS) vulnerability affecting Abandoned Cart Lite for WooCommerce up to version 6.8.0. The issue arises from improper neutralization of input during web page generation, allowing a shop manager with high privileges to inject malicious scripts. The vulnerability has a CVSS 3.1 base score of 5.9, indicating medium severity with network attack vector, low attack complexity, required privileges at high level, and user interaction required. The vulnerability impacts confidentiality, integrity, and availability to a limited extent. No patch or official remediation level has been published, and no known exploits have been reported in the wild.

Successful exploitation could allow a shop manager to execute arbitrary scripts in the context of the affected web application, potentially leading to limited confidentiality, integrity, and availability impacts. The attack requires high privileges and user interaction, limiting the scope of exploitation. There are no known active exploits in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict shop manager privileges to trusted users only and monitor for suspicious activity related to web page content generation. Avoid granting unnecessary high privileges that could be leveraged to exploit this vulnerability.