CVE-2026-6370

CVE-2026-6370 is a Stored Cross-Site Scripting (XSS) vulnerability in HashThemes Mini Ajax Cart for WooCommerce plugin, affecting versions through 1.3.4. This flaw allows improper neutralization of user input during web page generation, potentially enabling attackers to inject and execute malicious scripts. The vulnerability carries a CVSS score of 5.9 (MEDIUM severity) and requires network access with high privileges and user interaction to exploit. While the attack has limited scope and impact on confidentiality, integrity, and availability, the stored nature of the XSS means injected payloads persist and affect multiple users. There is no evidence of active exploitation in the wild, as the vulnerability is not listed on CISA's Known Exploited Vulnerabilities (KEV) catalog and maintains an inactive status on exploit tracking lists. The EPSS score of 0.0003 indicates minimal probability of exploitation in the immediate future, and the moderate FAUCET Risk Score of 43.0 suggests this represents a manageable security concern at present.