Shoplentor All In One Woocommerce Growth Store Enhancement Plugin
Monthly
Arbitrary PHP function execution in ShopLentor (woolentor-addons) for WordPress up to and including version 3.3.7 allows authenticated administrators to invoke any PHP callable on the server via the woolentoropt/v1/custom-action REST API endpoint. The root cause is the plugin's handle_action() method passing the user-supplied 'callback' parameter directly into PHP's call_user_func() with no allowlist restriction, enabling full server-side code execution under the web server's privilege context. No public exploit code or CISA KEV listing has been identified at time of analysis; however, the admin-level requirement limits the realistic attacker pool to compromised or malicious site administrators.
Reflected cross-site scripting in the ShopLentor (WooLentor Addons) WordPress plugin up to and including version 3.5.1 lets unauthenticated attackers inject arbitrary JavaScript into a page by abusing the name of a query-string parameter, which the WL: Product Horizontal Filter widget reflects unescaped into an option element value attribute. Exploitation requires the victim to click an attacker-supplied link that carries the payload in the parameter name (UI:R) and only works on published pages where that widget has actually been placed, so the result is non-persistent script execution scoped to the WordPress origin; the higher-value outcome, abuse of an authenticated administrator session, requires luring a logged-in admin to the crafted URL. No public exploit code or confirmed in-the-wild exploitation was identified at time of analysis, and the issue is assessed as a genuine but moderate-severity problem (CVSS 6.1, scope-changed reflected XSS) rather than a mass-exploitation candidate.
Authenticated SQL injection in ShopLentor for WooCommerce allows administrator-level attackers to extract sensitive data via the 'orderby' parameter. All versions up to and including 3.4.5 are affected. No public exploit or active exploitation is currently known.
Information disclosure in ShopLentor WordPress plugin versions ≤3.4.5 allows authenticated attackers with contributor-level access to read arbitrary wp_options rows whose values are stored as arrays-of-arrays containing 'title' keys, leading to cross-plugin data leakage of internal plugin news feeds, WooCommerce block pattern transients, and third-party configuration records. The vulnerability exists due to missing authorization checks on the user-controlled 'optionSection' parameter in the plugin’s API, and no public exploit or active exploitation has been reported.
Stored Cross-Site Scripting in ShopLentor WordPress plugin (versions up to 3.3.5) via the woolentor_quickview_button shortcode's button_text attribute allows authenticated attackers with Contributor-level access to inject arbitrary JavaScript that executes for all site visitors. The vulnerability stems from insufficient input sanitization and missing output escaping on user-supplied shortcode attributes. With a CVSS score of 6.4 and confirmed patch availability in version 3.3.6, this poses a moderate risk to WordPress installations using the plugin, particularly those with multiple contributor-level users.
Arbitrary PHP function execution in ShopLentor (woolentor-addons) for WordPress up to and including version 3.3.7 allows authenticated administrators to invoke any PHP callable on the server via the woolentoropt/v1/custom-action REST API endpoint. The root cause is the plugin's handle_action() method passing the user-supplied 'callback' parameter directly into PHP's call_user_func() with no allowlist restriction, enabling full server-side code execution under the web server's privilege context. No public exploit code or CISA KEV listing has been identified at time of analysis; however, the admin-level requirement limits the realistic attacker pool to compromised or malicious site administrators.
Reflected cross-site scripting in the ShopLentor (WooLentor Addons) WordPress plugin up to and including version 3.5.1 lets unauthenticated attackers inject arbitrary JavaScript into a page by abusing the name of a query-string parameter, which the WL: Product Horizontal Filter widget reflects unescaped into an option element value attribute. Exploitation requires the victim to click an attacker-supplied link that carries the payload in the parameter name (UI:R) and only works on published pages where that widget has actually been placed, so the result is non-persistent script execution scoped to the WordPress origin; the higher-value outcome, abuse of an authenticated administrator session, requires luring a logged-in admin to the crafted URL. No public exploit code or confirmed in-the-wild exploitation was identified at time of analysis, and the issue is assessed as a genuine but moderate-severity problem (CVSS 6.1, scope-changed reflected XSS) rather than a mass-exploitation candidate.
Authenticated SQL injection in ShopLentor for WooCommerce allows administrator-level attackers to extract sensitive data via the 'orderby' parameter. All versions up to and including 3.4.5 are affected. No public exploit or active exploitation is currently known.
Information disclosure in ShopLentor WordPress plugin versions ≤3.4.5 allows authenticated attackers with contributor-level access to read arbitrary wp_options rows whose values are stored as arrays-of-arrays containing 'title' keys, leading to cross-plugin data leakage of internal plugin news feeds, WooCommerce block pattern transients, and third-party configuration records. The vulnerability exists due to missing authorization checks on the user-controlled 'optionSection' parameter in the plugin’s API, and no public exploit or active exploitation has been reported.
Stored Cross-Site Scripting in ShopLentor WordPress plugin (versions up to 3.3.5) via the woolentor_quickview_button shortcode's button_text attribute allows authenticated attackers with Contributor-level access to inject arbitrary JavaScript that executes for all site visitors. The vulnerability stems from insufficient input sanitization and missing output escaping on user-supplied shortcode attributes. With a CVSS score of 6.4 and confirmed patch availability in version 3.3.6, this poses a moderate risk to WordPress installations using the plugin, particularly those with multiple contributor-level users.