{
 "id": "WPSEC-2026-2863",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2863/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2863/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2863/index.md",
 "title": "ShopLentor <= 3.5.7 - Unauthenticated Arbitrary Shortcode Execution via Gutenberg Template Rendering",
 "description": "The ShopLentor plugin for WordPress is vulnerable to arbitrary shortcode execution via Gutenberg-built WooCommerce templates in all versions up to, and including, 3.5.7. This is due to the plugin running do_shortcode() on the rendered output of the template's blocks, which can contain visitor-supplied data such as the search term shown by the Archive Title block on product search results. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes on sites using block-built ShopLentor templates.",
 "plugin": {
  "slug": "woolentor-addons",
  "name": "ShopLentor",
  "full_name": "ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin",
  "wordpress_org": "https://wordpress.org/plugins/woolentor-addons/",
  "advisories_url": "https://wpsec.com/vuln/plugin/woolentor-addons/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/woolentor-addons"
 },
 "type": "UNKNOWN",
 "cwe": [
  "CWE-94"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 6.5,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "3.5.8",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 3.5.8"
  ]
 },
 "introduced_in": null,
 "fixed_in": "3.5.8",
 "remediation": "Update to 3.5.8 or later.",
 "fix_released": "2026-11-10T11:03:45+00:00",
 "published": "2026-11-12T17:52:14+00:00",
 "updated": "2026-11-12T17:07:23.431242+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2863/",
  "https://plugins.svn.wordpress.org/woolentor-addons/tags/3.5.8/",
  "https://wordpress.org/plugins/woolentor-addons/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/woolentor-addons",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Medium",
  "as_of": "2026-11-12"
 }
}