Shoplentor All In One Woocommerce Growth Store Enhancement Plugin
Monthly
Arbitrary PHP function execution in ShopLentor (woolentor-addons) for WordPress up to and including version 3.3.7 allows authenticated administrators to invoke any PHP callable on the server via the woolentoropt/v1/custom-action REST API endpoint. The root cause is the plugin's handle_action() method passing the user-supplied 'callback' parameter directly into PHP's call_user_func() with no allowlist restriction, enabling full server-side code execution under the web server's privilege context. No public exploit code or CISA KEV listing has been identified at time of analysis; however, the admin-level requirement limits the realistic attacker pool to compromised or malicious site administrators.
Authenticated SQL injection in ShopLentor for WooCommerce allows administrator-level attackers to extract sensitive data via the 'orderby' parameter. All versions up to and including 3.4.5 are affected. No public exploit or active exploitation is currently known.
Information disclosure in ShopLentor WordPress plugin versions ≤3.4.5 allows authenticated attackers with contributor-level access to read arbitrary wp_options rows whose values are stored as arrays-of-arrays containing 'title' keys, leading to cross-plugin data leakage of internal plugin news feeds, WooCommerce block pattern transients, and third-party configuration records. The vulnerability exists due to missing authorization checks on the user-controlled 'optionSection' parameter in the plugin’s API, and no public exploit or active exploitation has been reported.
Stored Cross-Site Scripting in ShopLentor WordPress plugin (versions up to 3.3.5) via the woolentor_quickview_button shortcode's button_text attribute allows authenticated attackers with Contributor-level access to inject arbitrary JavaScript that executes for all site visitors. The vulnerability stems from insufficient input sanitization and missing output escaping on user-supplied shortcode attributes. With a CVSS score of 6.4 and confirmed patch availability in version 3.3.6, this poses a moderate risk to WordPress installations using the plugin, particularly those with multiple contributor-level users.
Arbitrary PHP function execution in ShopLentor (woolentor-addons) for WordPress up to and including version 3.3.7 allows authenticated administrators to invoke any PHP callable on the server via the woolentoropt/v1/custom-action REST API endpoint. The root cause is the plugin's handle_action() method passing the user-supplied 'callback' parameter directly into PHP's call_user_func() with no allowlist restriction, enabling full server-side code execution under the web server's privilege context. No public exploit code or CISA KEV listing has been identified at time of analysis; however, the admin-level requirement limits the realistic attacker pool to compromised or malicious site administrators.
Authenticated SQL injection in ShopLentor for WooCommerce allows administrator-level attackers to extract sensitive data via the 'orderby' parameter. All versions up to and including 3.4.5 are affected. No public exploit or active exploitation is currently known.
Information disclosure in ShopLentor WordPress plugin versions ≤3.4.5 allows authenticated attackers with contributor-level access to read arbitrary wp_options rows whose values are stored as arrays-of-arrays containing 'title' keys, leading to cross-plugin data leakage of internal plugin news feeds, WooCommerce block pattern transients, and third-party configuration records. The vulnerability exists due to missing authorization checks on the user-controlled 'optionSection' parameter in the plugin’s API, and no public exploit or active exploitation has been reported.
Stored Cross-Site Scripting in ShopLentor WordPress plugin (versions up to 3.3.5) via the woolentor_quickview_button shortcode's button_text attribute allows authenticated attackers with Contributor-level access to inject arbitrary JavaScript that executes for all site visitors. The vulnerability stems from insufficient input sanitization and missing output escaping on user-supplied shortcode attributes. With a CVSS score of 6.4 and confirmed patch availability in version 3.3.6, this poses a moderate risk to WordPress installations using the plugin, particularly those with multiple contributor-level users.