CVE-2026-85575
MediumCVSS 6.4Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
The ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution with eCommerce Templates & Woo Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘shopengine_product_title_header_size’ parameter in all versions up to, and including, 4.9.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Risk Assessment
Session hijacking, data theft, or malware distribution within the context of a trusted site.
Recommendation
Update the ShopEngine plugin to a version newer than 4.9.5 that includes sanitization and escaping fixes.
Other vulnerabilities in ShopEngine
See all- CVE-2026-75971High
The ShopEngine plugin for WordPress is vulnerable to privilege escalation in all versions up to and including 4.9.4. The `rum_importer()` function is registered on the `import_start` hook without proper capability checks, allowing authenticated attackers with Shop Manager-level access to write arbitrary WordPress options, including setting `users_can_register` to 1 and `default_role` to administrator, enabling open self-registration of Administrator accounts and full site takeover.
- CVE-2025-11888Low
The ShopEngine Elementor WooCommerce Builder Addon plugin for WordPress up to version 4.8.4 is vulnerable to unauthorized data modification due to insufficient capability checks in the post_deactive() and post_activate() functions. This allows authenticated attackers with Editor-level access or above to activate and deactivate licenses.
Original NVD description (English source)
The ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution with eCommerce Templates & Woo Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘shopengine_product_title_header_size’ parameter in all versions up to, and including, 4.9.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS