Shopengine Elementor Woocommerce Builder Addon All In One Woocommerce Solution With Ecommerce Templates Woo Widgets
Monthly
Privilege escalation in ShopEngine (all versions up to and including 4.9.4) allows Shop Manager-level authenticated users to achieve full WordPress site takeover by injecting arbitrary core options through a malicious WXR import file. The plugin's `rum_importer()` function is hooked to the WordPress core `import_start` action without any plugin-owned capability check or allowlist filtering, meaning attacker-controlled `<wp_option>` pairs from a crafted import file flow directly into `update_option()` - enabling manipulation of `users_can_register` and `default_role` to open administrator self-registration. No CISA KEV listing or EPSS score was present in the provided data; exploitation requires an existing Shop Manager account and WooCommerce's grant of the `import` capability to that role, but once those conditions are met the path to full site compromise is straightforward and documented.
Stored Cross-Site Scripting in the ShopEngine Elementor WooCommerce Builder Addon plugin for WordPress (versions up to and including 4.9.5) allows authenticated attackers with Author-level access or higher to persistently inject arbitrary JavaScript via the `shopengine_product_title_header_size` parameter. The injected payload executes in any site visitor's browser upon loading an affected page, enabling session hijacking, credential theft, or malicious redirects. No public exploit code has been identified at time of analysis, and it is not listed in the CISA KEV catalog.
Privilege escalation in ShopEngine (all versions up to and including 4.9.4) allows Shop Manager-level authenticated users to achieve full WordPress site takeover by injecting arbitrary core options through a malicious WXR import file. The plugin's `rum_importer()` function is hooked to the WordPress core `import_start` action without any plugin-owned capability check or allowlist filtering, meaning attacker-controlled `<wp_option>` pairs from a crafted import file flow directly into `update_option()` - enabling manipulation of `users_can_register` and `default_role` to open administrator self-registration. No CISA KEV listing or EPSS score was present in the provided data; exploitation requires an existing Shop Manager account and WooCommerce's grant of the `import` capability to that role, but once those conditions are met the path to full site compromise is straightforward and documented.
Stored Cross-Site Scripting in the ShopEngine Elementor WooCommerce Builder Addon plugin for WordPress (versions up to and including 4.9.5) allows authenticated attackers with Author-level access or higher to persistently inject arbitrary JavaScript via the `shopengine_product_title_header_size` parameter. The injected payload executes in any site visitor's browser upon loading an affected page, enabling session hijacking, credential theft, or malicious redirects. No public exploit code has been identified at time of analysis, and it is not listed in the CISA KEV catalog.