What is the CVSS score of CVE-2026-4059?

CVE-2026-4059 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

WordPress CVE-2026-4059

EUVD-2026-22217 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-04-14 Wordfence

XSS WordPress

6.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 14, 2026 - 04:11 vuln.today

EUVD ID Assigned

Apr 14, 2026 - 04:00 euvd

EUVD-2026-22217

Analysis Generated

Apr 14, 2026 - 04:00 vuln.today

CVE Published

Apr 14, 2026 - 03:37 nvd

MEDIUM 6.4

DescriptionCVE.org

The ShopLentor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the woolentor_quickview_button shortcode's button_text attribute in all versions up to, and including, 3.3.5. This is due to insufficient input sanitization and missing output escaping on user-supplied shortcode attributes. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

Stored Cross-Site Scripting in ShopLentor WordPress plugin (versions up to 3.3.5) via the woolentor_quickview_button shortcode's button_text attribute allows authenticated attackers with Contributor-level access to inject arbitrary JavaScript that executes for all site visitors. The vulnerability stems from insufficient input sanitization and missing output escaping on user-supplied shortcode attributes. With a CVSS score of 6.4 and confirmed patch availability in version 3.3.6, this poses a moderate risk to WordPress installations using the plugin, particularly those with multiple contributor-level users.

Technical ContextAI

The ShopLentor plugin (CPE: cpe:2.3:a:devitemsllc:shoplentor_-_all-in-one_woocommerce_growth_&_store_enhancement_plugin) implements the woolentor_quickview_button shortcode without proper input validation and output encoding. The button_text attribute, processed in the Frontend/Shortcode.php file (line 61), is rendered directly into the quickview-button.php template without applying WordPress escaping functions such as esc_attr() or esc_html(). This is a classic Stored XSS vulnerability (CWE-79: Improper Neutralization of Input During Web Page Generation) where user-controlled data reaches the output context unfiltered. Shortcode attributes in WordPress are typically user-controllable by authenticated users with post/page editing capabilities, making this a natural attack surface when sanitization is omitted.

RemediationAI

Upgrade the ShopLentor plugin to version 3.3.6 or later, which includes fixes for shortcode attribute sanitization and output escaping. The patch is available through the WordPress plugin repository (changeset 3493664 in the trunk branch confirms the fix). Site administrators should update via WordPress Admin > Plugins > Installed Plugins and click Update, or manually upload the patched version. If immediate patching is not possible, consider temporarily disabling the woolentor_quickview_button shortcode or restricting contributor-level access to only trusted users until the update can be applied. Refer to the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/fdf0b13e-154c-4007-bfc2-5346d906f7ca?source=cve for additional context and verification.