ShopLentor CVE-2026-92554

Requires a page that renders the WL: Product Horizontal Filter widget (an Elementor/ShopLentor widget that must be added to a published page) - pages without this widget are not affected. Exploitation is unauthenticated (PR:N) but requires victim user interaction (UI:R): the target must click an attacker-supplied link whose query-string parameter NAME carries the payload, which is reflected into an option element's value="..." attribute without escaping. Impact is limited to reflected (non-persistent) in-browser script execution scoped to the WordPress origin; the higher-value outcome (admin session abuse) requires luring an authenticated administrator. Affected: ShopLentor/WooLentor all versions up to and including 3.5.1.

This is a genuine but moderate-severity issue. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, base 6.1) describes an unauthenticated, network-reachable reflected XSS that requires victim user interaction (clicking an attacker-crafted link). Reflected XSS is inherently a per-victim, socially-engineered attack rather than a mass-exploitable server compromise, which caps real-world impact - no confidentiality/integrity of the server itself, only in-browser script execution in the victim's session (C:L/I:L, A:N). No EPSS score, no CISA KEV listing, and no public POC are present in the supplied intelligence, so exploitation status is 'no public exploit identified at time of analysis'; this is not evidence of active exploitation. The scope change (S:C) reflects that injected script executes in the browser's WordPress origin, potentially reaching admin session context if an authenticated admin is lured. Overall this is a standard-priority patch-management item, not an emergency: high install base raises aggregate exposure, but UI:R and the reflected (non-persistent) nature keep individual-target risk contained. Note the fix appears delivered in changeset 3699757 (referenced), though a clean fixed version number is not explicitly stated in the input - verify the exact patched release.

An attacker crafts a URL to a page rendering the WL: Product Horizontal Filter widget, embedding an XSS payload as a query-string parameter NAME (not value), which the widget reflects unescaped into an option element's value="..." attribute. The attacker sends this link to a victim (e.g., via phishing or a forum post); when the victim clicks and the page loads, the payload breaks out of the attribute context and executes arbitrary JavaScript in their browser under the site's origin. No public POC or active exploitation is identified in the supplied data.