6.4 Medium

CVE-2026-4059 The ShopLentor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the woolentor_quickview_button…

Description

The ShopLentor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the woolentor_quickview_button shortcode's button_text attribute in all versions up to, and including, 3.3.5. This is due to insufficient input sanitization and missing output escaping on user-supplied shortcode attributes. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Affected products and versions

Product	Affected versions	Fixed in
ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin 3.3	earliest → 3.3.5	No fix stated

References

www.wordfence.com www.wordfence.com
plugins.trac.wordpress.org plugins.trac.wordpress.org
plugins.trac.wordpress.org plugins.trac.wordpress.org
plugins.trac.wordpress.org plugins.trac.wordpress.org
ti.wordfence.io ti.wordfence.io
plugins.trac.wordpress.org plugins.trac.wordpress.org
plugins.trac.wordpress.org plugins.trac.wordpress.org

Timeline

Published April 14, 2026
Last modified April 14, 2026

The 23 CVEs of ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin →

CVE-2026-92554 The ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin plugin for WordPress is vulnerable to… 6.1 Medium CVE-2026-6020 The ShopLentor plugin for WordPress is vulnerable to arbitrary function execution via the… 7.2 High CVE-2026-16811 The ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin plugin for WordPress is vulnerable to… 4.9 Medium CVE-2026-16797 The ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin plugin for WordPress is vulnerable to Insecure… 4.3 Medium

Track this CVE