CVE-2026-92554 in ShopLentor Plugin
Summary
by MITRE • 09/18/2026
The ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via Query-String Parameter Name in all versions up to, and including, 3.5.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. The vulnerability is triggered via the WL: Product Horizontal Filter widget, which reflects attacker-supplied query-string parameter names from the current URL into option element value attributes without escaping, allowing payload breakout from the value="..." attribute context.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/18/2026
The ShopLentor plugin for WordPress presents a significant security risk due to a reflected cross-site scripting vulnerability present in all versions up through 3.5.1. This flaw stems directly from insufficient input sanitization and output escaping mechanisms within the application code, specifically affecting how query-string parameter names are processed. The vulnerability is located within the WL: Product Horizontal Filter widget, which serves as an interface for users to filter products on WooCommerce stores. When a user interacts with this widget or navigates to a page containing it, the plugin takes the raw values from the URL's query string and injects them directly into HTML option element value attributes without performing any necessary validation or encoding steps. This lack of proper handling allows attacker-supplied data to be reflected back into the browser environment in an executable context.
The technical nature of this flaw is classified as a Reflected Cross-Site Scripting vulnerability, which aligns with CWE-79 under the Common Weakness Enumeration standards. The attack vector relies on social engineering tactics where an unauthenticated attacker crafts a malicious URL containing specially designed query-string parameter names that include JavaScript payloads. Because the plugin reflects these parameter names directly into the HTML structure without escaping special characters such as quotes or angle brackets, the payload can break out of its intended attribute context. Specifically, by injecting closing quote sequences followed by event handlers like onerror or onload, an attacker can execute arbitrary web scripts within the victim's browser session. This breakout from the value="..." attribute context is critical because it transforms a simple data reflection into a functional code execution vector.
The operational impact of this vulnerability extends beyond mere page defacement. Since the script executes in the context of the authenticated user viewing the vulnerable page, attackers can leverage this access to perform actions on behalf of the victim. This includes stealing session cookies or authentication tokens, which could lead to account takeover if the victim is an administrator or a customer with sensitive data stored locally. Furthermore, the attacker may redirect users to phishing sites designed to harvest credentials or install malware via drive-by downloads. The vulnerability affects all versions up to 3.5.1, meaning any WordPress site utilizing this plugin for e-commerce functionality remains exposed until remediation occurs. The unauthenticated nature of the exploit means that no prior login is required to initiate the attack, significantly lowering the barrier for entry and increasing the potential scale of impact across vulnerable installations.
Mitigation strategies must address both immediate risk reduction and long-term security posture improvements. Administrators should immediately update the ShopLentor plugin to version 3.5.2 or later, where this specific input handling flaw has been corrected with proper output escaping functions such as esc_attr in WordPress development standards. For sites that cannot be updated instantly due to compatibility concerns, implementing a Web Application Firewall can provide temporary protection by filtering out malicious query-string patterns before they reach the application logic. Additionally, developers should enforce strict Content Security Policy headers to mitigate the impact of any successful script injection attempts by restricting the sources from which scripts can be loaded and executed. Regular security audits focusing on input validation and output encoding practices are essential to prevent similar vulnerabilities in future development cycles.
This incident highlights the importance of adhering to secure coding standards when handling dynamic user input, particularly within WordPress plugins that interact with WooCommerce data structures. The reflection of query-string parameters into HTML attributes without escaping is a common pattern that frequently leads to XSS flaws. Security professionals should monitor for updates from plugin vendors and ensure that all third-party extensions are kept current. Awareness training for developers regarding the specific risks associated with attribute context breakout can further reduce the likelihood of recurrence. By treating every piece of user-supplied data as potentially hostile until proven safe, organizations can significantly harden their WordPress environments against this class of web-based attacks.