CVE-2026-85575 in ShopEngine Elementor WooCommerce Builder Addon Plugin
Summary
by MITRE • 09/15/2026
The ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution with eCommerce Templates & Woo Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘shopengine_product_title_header_size’ parameter in all versions up to, and including, 4.9.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/15/2026
The ShopEngine Elementor WooCommerce Builder Addon is a widely utilized WordPress plugin designed to enhance the functionality of online stores built on the WooCommerce platform by providing specialized templates and widgets for product displays. A critical security vulnerability has been identified within this software, specifically affecting all versions up through 4.9.5. This flaw manifests as a Stored Cross-Site Scripting issue triggered by improper handling of input data associated with the shopengine_product_title_header_size parameter. The root cause lies in insufficient input sanitization and output escaping mechanisms during the processing and rendering of user-supplied content, allowing malicious actors to embed executable JavaScript code directly into stored data structures within the application database.
From a technical perspective, this vulnerability classifies under CWE-79, which describes Improper Neutralization of Input During Web Page Generation commonly known as Cross-Site Scripting. The specific nature of this flaw is categorized as Stored XSS because the injected script is saved on the target server rather than being reflected immediately in an HTTP response. When a user with Author-level access or higher interacts with the plugin's configuration interface, they can manipulate the shopengine_product_title_header_size parameter to include malicious payloads. Because WordPress plugins often store such settings persistently, the malicious code becomes part of the page content served to all subsequent visitors who view pages containing product titles formatted by this addon.
The operational impact of this vulnerability is significant due to its persistence and broad exposure potential. Unlike reflected XSS attacks that require tricking a user into clicking a specially crafted link, stored XSS ensures that every visitor accessing an affected page will execute the injected script in their browser context. This can lead to severe consequences including session hijacking where attackers steal authentication cookies to impersonate legitimate users, defacement of website content, redirection to malicious sites for phishing or malware distribution, and potential compromise of sensitive customer data if the site handles personal information. The requirement for Author-level access means that while not trivially exploitable by unauthenticated outsiders, it poses a serious threat from compromised accounts or insider threats within organizations managing WordPress installations.
In terms of industry-standard attack frameworks, this vulnerability aligns with MITRE ATT&CK technique T1059 which covers Command and Scripting Interpreter execution via web applications. The attacker leverages the application's trust in stored data to execute arbitrary code on client machines, effectively turning legitimate website traffic into a vector for malicious activity. This highlights the importance of securing administrative interfaces even when they require elevated privileges, as these accounts often have broader access to site configurations and user management tools that can be abused once compromised.
Mitigation strategies must address both immediate remediation and long-term security hygiene. The most effective solution is to upgrade the ShopEngine plugin to version 4.9.6 or later where this vulnerability has been patched by implementing proper input validation and output encoding functions consistent with WordPress coding standards. Administrators should also enforce strict role-based access control policies, ensuring that only trusted individuals have Author-level permissions and regularly auditing user accounts for signs of compromise. Additionally, deploying a Web Application Firewall can provide an additional layer of defense by filtering out malicious payloads before they reach the application logic. Regular security audits and code reviews focusing on data handling practices are essential to prevent similar vulnerabilities in future updates or custom integrations involving this plugin ecosystem.