CVE-2026-6287
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
The ShopLentor plugin for WordPress up to version 3.3.8 is vulnerable to stored XSS via the 'blockUniqId' attribute in Product Grid blocks. Authenticated attackers with contributor-level access can inject arbitrary scripts.
Risk Assessment
An attacker can inject a malicious script that executes for every visitor, potentially leading to session theft or redirects to malicious sites.
Recommendation
Update the ShopLentor plugin to the latest version that includes a fix for XSS.
Other vulnerabilities in ShopLentor
See all- CVE-2026-6020High
The ShopLentor plugin for WordPress up to version 3.3.7 is vulnerable to arbitrary function execution via the `woolentoropt/v1/custom-action` REST API endpoint. The `handle_action()` method passes user-supplied input directly to `call_user_func()` without an allowlist of permitted callbacks. Authenticated attackers with Administrator-level access or above can execute arbitrary PHP callable functions.
- CVE-2026-16797Medium
The ShopLentor plugin for WordPress up to version 3.4.5 is vulnerable to Insecure Direct Object Reference via the 'optionSection' parameter. Authenticated attackers with contributor-level access or higher can read arbitrary WordPress option rows, including internal plugin news feed data, WooCommerce block pattern transients, and third-party configuration records stored as arrays-of-arrays with 'title' keys.
Original NVD description (English source)
The ShopLentor - WooCommerce Builder for Elementor & Gutenberg plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'blockUniqId' block attribute in multiple Product Gride blocks in versions up to, and including, 3.3.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.