Hasthemes Shoplentor vulnerabilities

CVE-2025-12493 [CRITICAL] CWE-22 CVE-2025-12493: The ShopLentor – WooCommerce Builder for Elementor & Gutenberg +21 Modules – All in One Solution (fo The ShopLentor – WooCommerce Builder for Elementor & Gutenberg +21 Modules – All in One Solution (formerly WooLentor) plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.2.5 via the 'load_template' function. This makes it possible for unauthenticated attackers to include and execute arbitrary .php file

CVE-2023-0232 [CRITICAL] CWE-502 CVE-2023-0232: The ShopLentor WordPress plugin before 2.5.4 unserializes user input from cookies in order to track The ShopLentor WordPress plugin before 2.5.4 unserializes user input from cookies in order to track viewed products and user data, which could lead to PHP Object Injection.

CVE-2024-4566 [HIGH] CWE-862 CVE-2024-4566: The ShopLentor plugin for WordPress is vulnerable to unauthorized modification of data due to a miss The ShopLentor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajax_dismiss function in all versions up to, and including, 2.8.8. This makes it possible for authenticated attackers, with contributor-level access and above, to set arbitrary WordPress options to "true". NOTE: This vulnerabil

CVE-2025-3775 [MEDIUM] CWE-918 CVE-2025-3775: The ShopLentor – WooCommerce Builder for Elementor & Gutenberg +20 Modules – All in One Solution (fo The ShopLentor – WooCommerce Builder for Elementor & Gutenberg +20 Modules – All in One Solution (formerly WooLentor) plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 3.1.2 via the woolentor_template_proxy function. This makes it possible for unauthenticated attackers to make web requests to arbit

CVE-2024-9538 [MEDIUM] CWE-200 CVE-2024-9538: The ShopLentor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions The ShopLentor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.9.8 via the 'render' function in includes/addons/wl_faq.php. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive private, pending, and draft Elementor template data.

CVE-2022-47172 [HIGH] CWE-352 CVE-2022-47172: Cross-Site Request Forgery (CSRF) vulnerability in HasThemes ShopLentor plugin <= 2.6.2 versions. Cross-Site Request Forgery (CSRF) vulnerability in HasThemes ShopLentor plugin <= 2.6.2 versions.

CVE-2024-2868 [MEDIUM] CWE-79 CVE-2024-2868: The ShopLentor – WooCommerce Builder for Elementor & Gutenberg +12 Modules – All in One Solution (fo The ShopLentor – WooCommerce Builder for Elementor & Gutenberg +12 Modules – All in One Solution (formerly WooLentor) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the slitems parameter in the WL Special Day Offer Widget in all versions up to, and including, 2.8.3 due to insufficient input sanitization and output escaping. This

CVE-2023-6327 [MEDIUM] CWE-862 CVE-2023-6327: The ShopLentor (formerly WooLentor) plugin for WordPress is vulnerable to unauthorized access of dat The ShopLentor (formerly WooLentor) plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the purchased_new_products function in all versions up to, and including, 2.8.7. This makes it possible for unauthenticated attackers to view all products purchased in the past week, along with the users that purch

CVE-2024-34767 [MEDIUM] CWE-79 CVE-2024-34767: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerab Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in HasThemes ShopLentor allows Stored XSS.This issue affects ShopLentor: from n/a through 2.8.7.

CVE-2025-11823 [MEDIUM] CWE-80 CVE-2025-11823: The ShopLentor – WooCommerce Builder for Elementor & Gutenberg +21 Modules – All in One Solution plu The ShopLentor – WooCommerce Builder for Elementor & Gutenberg +21 Modules – All in One Solution plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'button_exist_text' parameter in the 'wishsuite_button' shortcode in all versions up to, and including, 3.2.4 due to insufficient input sanitization and output escaping. This makes

CVE-2024-1960 [MEDIUM] CWE-79 CVE-2024-1960: The ShopLentor – WooCommerce Builder for Elementor & Gutenberg +12 Modules – All in One Solution (fo The ShopLentor – WooCommerce Builder for Elementor & Gutenberg +12 Modules – All in One Solution (formerly WooLentor) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Special Offer Day Widget Banner Link in all versions up to, and including, 2.8.1 due to insufficient input sanitization and output escaping on user supplied attri

CVE-2024-5530 [MEDIUM] CWE-79 CVE-2024-5530: The ShopLentor – WooCommerce Builder for Elementor & Gutenberg +12 Modules – All in One Solution (fo The ShopLentor – WooCommerce Builder for Elementor & Gutenberg +12 Modules – All in One Solution (formerly WooLentor) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's WL: Product Horizontal Filter widget in all versions up to, and including, 2.9.0 due to insufficient input sanitization and output escaping on user suppl

CVE-2024-2946 [MEDIUM] CWE-79 CVE-2024-2946: The ShopLentor – WooCommerce Builder for Elementor & Gutenberg +12 Modules – All in One Solution (fo The ShopLentor – WooCommerce Builder for Elementor & Gutenberg +12 Modules – All in One Solution (formerly WooLentor) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's QR Code Widget in all versions up to, and including, 2.8.4 due to insufficient input sanitization and output escaping on user supplied attributes. This m

CVE-2024-1057 [MEDIUM] CWE-79 CVE-2024-1057: The ShopLentor – WooCommerce Builder for Elementor & Gutenberg +10 Modules – All in One Solution (fo The ShopLentor – WooCommerce Builder for Elementor & Gutenberg +10 Modules – All in One Solution (formerly WooLentor) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wishsuite_button' shortcode in all versions up to, and including, 2.8.1 due to insufficient input sanitization and output escaping on user supplied attr

CVE-2023-0231 [MEDIUM] CWE-79 CVE-2023-0231: The ShopLentor WordPress plugin before 2.5.4 does not validate and escape some of its block options The ShopLentor WordPress plugin before 2.5.4 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.

CVE-2024-3991 [MEDIUM] CWE-79 CVE-2024-3991: The ShopLentor – WooCommerce Builder for Elementor & Gutenberg +12 Modules – All in One Solution (fo The ShopLentor – WooCommerce Builder for Elementor & Gutenberg +12 Modules – All in One Solution (formerly WooLentor) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the _id attribute in the Horizontal Product Filter in all versions up to, and including, 2.8.7 due to insufficient input sanitization and output escaping on user supp

CVE-2025-1527 [MEDIUM] CWE-79 CVE-2025-1527: The ShopLentor – WooCommerce Builder for Elementor & Gutenberg +20 Modules – All in One Solution (fo The ShopLentor – WooCommerce Builder for Elementor & Gutenberg +20 Modules – All in One Solution (formerly WooLentor) plugin for WordPress is vulnerable to a Stored DOM-Based Cross-Site Scripting via the plugin's Flash Sale Countdown module in all versions up to, and including, 3.1.0 due to insufficient input sanitization and output escaping on user su

CVE-2025-58990 [MEDIUM] CWE-79 CVE-2025-58990: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DevItems ShopLentor woolentor-addons allows Stored XSS.This issue affects ShopLentor: from n/a through <= 3.2.0.

CVE-2024-3345 [MEDIUM] CWE-79 CVE-2024-3345: The ShopLentor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wo The ShopLentor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's woolentorsearch shortcode in all versions up to, and including, 2.8.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to in

CVE-2023-7067 [MEDIUM] CWE-862 CVE-2023-7067: The ShopLentor – WooCommerce Builder for Elementor & Gutenberg +10 Modules – All in One Solution (fo The ShopLentor – WooCommerce Builder for Elementor & Gutenberg +10 Modules – All in One Solution (formerly WooLentor) plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'woolentor_template_store' function in all versions up to, and including, 2.8.1. This makes it possible for authenticated