CVE-2025-11823
MediumCVSS 6.4Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
The ShopLentor plugin for WordPress in versions up to and including 3.2.4 is vulnerable to Stored Cross-Site Scripting via the 'button_exist_text' parameter in the 'wishsuite_button' shortcode due to insufficient input sanitization and output escaping. An authenticated attacker with Contributor-level access or above can inject arbitrary web scripts into pages.
Risk Assessment
The malicious script will execute in the browser of every user visiting the infected page, potentially leading to session data theft or account takeover. The risk applies to sites with the ShopLentor plugin version <= 3.2.4.
Recommendation
Update the ShopLentor plugin to the latest version (above 3.2.4). Additionally, review existing pages for unknown scripts.
Other vulnerabilities in ShopLentor
See all- CVE-2026-92554Medium
The ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via Query-String Parameter Name in all versions up to, and including, 3.5.1 due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts if they trick a user into clicking a link.
- CVE-2026-6020High
The ShopLentor plugin for WordPress up to version 3.3.7 is vulnerable to arbitrary function execution via the `woolentoropt/v1/custom-action` REST API endpoint. The `handle_action()` method passes user-supplied input directly to `call_user_func()` without an allowlist of permitted callbacks. Authenticated attackers with Administrator-level access or above can execute arbitrary PHP callable functions.
- CVE-2026-16797Medium
The ShopLentor plugin for WordPress up to version 3.4.5 is vulnerable to Insecure Direct Object Reference via the 'optionSection' parameter. Authenticated attackers with contributor-level access or higher can read arbitrary WordPress option rows, including internal plugin news feed data, WooCommerce block pattern transients, and third-party configuration records stored as arrays-of-arrays with 'title' keys.
- CVE-2026-6287Medium
The ShopLentor plugin for WordPress up to version 3.3.8 is vulnerable to stored XSS via the 'blockUniqId' attribute in Product Grid blocks. Authenticated attackers with contributor-level access can inject arbitrary scripts.
Original NVD description (English source)
The ShopLentor – WooCommerce Builder for Elementor & Gutenberg +21 Modules – All in One Solution plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'button_exist_text' parameter in the 'wishsuite_button' shortcode in all versions up to, and including, 3.2.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS