CVE-2024-2868 in ShopLentor Plugin
Summary
by MITRE • 04/04/2024
The ShopLentor – WooCommerce Builder for Elementor & Gutenberg +12 Modules – All in One Solution (formerly WooLentor) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the slitems parameter in the WL Special Day Offer Widget in all versions up to, and including, 2.8.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor access or above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 04/14/2026
The vulnerability identified as CVE-2024-2868 affects the ShopLentor plugin for WordPress, which serves as a comprehensive WooCommerce builder solution integrating Elementor and Gutenberg functionalities. This plugin version range up to 2.8.3 contains a critical stored cross-site scripting flaw that specifically targets the WL Special Day Offer Widget component. The vulnerability arises from inadequate input sanitization and output escaping mechanisms within the plugin's codebase, creating a persistent security weakness that can be exploited by malicious actors with relatively low privileges. The flaw is particularly concerning because it allows authenticated attackers who possess contributor-level access or higher to inject malicious scripts that will execute whenever any user accesses pages containing the injected content.
The technical exploitation of this vulnerability occurs through manipulation of the slitems parameter within the WL Special Day Offer Widget functionality. When an attacker with appropriate privileges submits malicious input through this parameter, the data is stored in the WordPress database without proper sanitization. This stored data is then subsequently rendered on pages without adequate output escaping, creating a persistent XSS vector that affects all users who view the compromised pages. The vulnerability operates under CWE-79 which specifically addresses Cross-Site Scripting flaws, and aligns with ATT&CK technique T1566.001 for Initial Access through spearphishing attachments. The stored nature of this vulnerability means that the malicious scripts remain active until manually removed from the database, potentially affecting multiple users over extended periods.
The operational impact of CVE-2024-2868 extends beyond simple script execution as it provides attackers with a persistent foothold within the WordPress environment. Contributors and higher privilege users can leverage this vulnerability to execute malicious code in the context of other users' browsers, potentially enabling session hijacking, credential theft, or redirection to malicious sites. The attack surface is particularly broad since the plugin's functionality integrates with WooCommerce and Elementor, meaning that compromised pages could include product listings, shop pages, and various administrative interfaces. This vulnerability could facilitate more sophisticated attacks such as privilege escalation or lateral movement within the WordPress installation, as the injected scripts could potentially access sensitive administrative functions or user data. The persistence of stored XSS makes this vulnerability particularly dangerous for sites with high user activity or those that frequently update content through contributor accounts.
Mitigation strategies for CVE-2024-2868 should prioritize immediate plugin updates to versions that address the identified sanitization and escaping deficiencies. System administrators should implement strict input validation and output escaping measures across all user-contributed content areas, particularly within the affected widget functionality. Access controls should be reviewed to ensure that contributor accounts have minimal necessary privileges, and regular security audits should monitor for unauthorized modifications to plugin components. Network-based security solutions can help detect suspicious script injections, while browser security features such as Content Security Policy headers can provide additional protection against script execution. Organizations should also maintain comprehensive backup strategies to quickly restore compromised systems and implement monitoring for unusual activity patterns that might indicate exploitation attempts. The vulnerability demonstrates the critical importance of proper input sanitization and output escaping in preventing persistent XSS attacks, aligning with security best practices outlined in OWASP Top Ten and NIST cybersecurity guidelines.