# ShopLentor <= 3.5.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Free Shipping Bar Shortcode Attributes

- **ID:** WPSEC-2026-2862
- **Plugin:** ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin (`woolentor-addons`), https://wordpress.org/plugins/woolentor-addons/
- **Affected versions:** from 3.4.3 before 3.5.8
- **Fixed in:** 3.5.8 (Update to 3.5.8 or later.)
- **Severity:** Medium 6.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N)
- **Weakness:** CWE-79
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-11-12)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/woolentor-addons
- **Fix released:** 2026-11-10
- **Published:** 2026-11-12
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2862/

## Description

The ShopLentor plugin for WordPress is vulnerable to DOM-based Stored Cross-Site Scripting via the 'message' and 'message_success' attributes of the woolentor_free_shipping_bar shortcode in all versions from 3.4.3 up to, and including, 3.5.7. This is due to insufficient input sanitization: the plugin's free shipping bar script reads the attribute values back from data attributes and writes them into the page with innerHTML. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

## References

- https://wpsec.com/vuln/WPSEC-2026-2862/
- https://plugins.svn.wordpress.org/woolentor-addons/tags/3.5.8/
- https://wordpress.org/plugins/woolentor-addons/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2862/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.