ShopLentor <= 3.5.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Free Shipping Bar Shortcode Attributes
- ID
- WPSEC-2026-2862
- Plugin
- ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin (woolentor-addons)
- Affected
- from 3.4.3 before 3.5.8
- Remediation
- Update to 3.5.8 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
- Weakness
- CWE-79
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-11-12
- Attack surface
- ShopLentor on WPSec AttackSurface
- Fix released
- Published
Description
The ShopLentor plugin for WordPress is vulnerable to DOM-based Stored Cross-Site Scripting via the 'message' and 'message_success' attributes of the woolentor_free_shipping_bar shortcode in all versions from 3.4.3 up to, and including, 3.5.7. This is due to insufficient input sanitization: the plugin's free shipping bar script reads the attribute values back from data attributes and writes them into the page with innerHTML. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
References
- https://wpsec.com/vuln/WPSEC-2026-2862/
- https://plugins.svn.wordpress.org/woolentor-addons/tags/3.5.8/
- https://wordpress.org/plugins/woolentor-addons/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS