ShopLentor vulnerabilities

The ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via Query-String Parameter Name in all versions up to, and including, 3.5.1 due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts if they trick a user into clicking a link.

The ShopLentor plugin for WordPress up to version 3.3.7 is vulnerable to arbitrary function execution via the `woolentoropt/v1/custom-action` REST API endpoint. The `handle_action()` method passes user-supplied input directly to `call_user_func()` without an allowlist of permitted callbacks. Authenticated attackers with Administrator-level access or above can execute arbitrary PHP callable functions.

The ShopLentor plugin for WordPress up to version 3.4.5 is vulnerable to Insecure Direct Object Reference via the 'optionSection' parameter. Authenticated attackers with contributor-level access or higher can read arbitrary WordPress option rows, including internal plugin news feed data, WooCommerce block pattern transients, and third-party configuration records stored as arrays-of-arrays with 'title' keys.

The ShopLentor plugin for WordPress up to version 3.3.8 is vulnerable to stored XSS via the 'blockUniqId' attribute in Product Grid blocks. Authenticated attackers with contributor-level access can inject arbitrary scripts.

The ShopLentor plugin for WordPress in versions up to and including 3.2.4 is vulnerable to Stored Cross-Site Scripting via the 'button_exist_text' parameter in the 'wishsuite_button' shortcode due to insufficient input sanitization and output escaping. An authenticated attacker with Contributor-level access or above can inject arbitrary web scripts into pages.