devitemsllc ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin vulnerabilities

26 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 12 published in the last 12 months.

Check whether your devitemsllc ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin version is affected

Latest devitemsllc ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin vulnerabilities

CVE-2026-92554 — ShopLentor <= 3.5.1 - Reflected Cross-Site Scripting via Query-String Parameter Name (CVSS 6.1)
CVE-2026-6020 — ShopLentor <= 3.3.7 - Authenticated (Administrator+) Arbitrary Function Execution via 'callback' Parameter via REST API (CVSS 7.2)
CVE-2026-16811 — ShopLentor <= 3.4.5 - Authenticated (Administrator+) SQL Injection via 'orderby' Parameter (CVSS 4.9)
CVE-2026-16797 — ShopLentor <= 3.4.5 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Exposure via 'optionSection' Parameter (CVSS 4.3)
CVE-2026-6287 — ShopLentor - WooCommerce Builder for Elementor & Gutenberg <= 3.3.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Product Grid 'blockUniqId' Block Attribute (CVSS 5.4)
CVE-2026-4059 — ShopLentor <= 3.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'button_text' Shortcode Attribute (CVSS 6.4)
CVE-2026-1714 — ShopLentor <= 3.3.2 - Unauthenticated Email Relay Abuse via 'woolentor_suggest_price_action' AJAX Action (CVSS 8.6)
CVE-2025-12493 — ShopLentor <= 3.2.5 - Unauthenticated Local PHP File Inclusion via 'load_template' (CVSS 9.8)
CVE-2025-11823 — ShopLentor – WooCommerce Builder for Elementor & Gutenberg +21 Modules – All in One Solution <= 3.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 5.4)
CVE-2025-58990 — WordPress ShopLentor Plugin <= 3.2.0 - Cross Site Scripting (XSS) Vulnerability (CVSS 5.4)
CVE-2025-3775 — ShopLentor – WooCommerce Builder for Elementor & Gutenberg +20 Modules – All in One Solution (formerly WooLentor) <= 3.1.2 - Unauthenticated Server-Side Request Forgery via URL Parameter (CVSS 6.5)
CVE-2025-1527 — ShopLentor – WooCommerce Builder for Elementor & Gutenberg +20 Modules – All in One Solution (formerly WooLentor) <= 3.1.0 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Flash Sale Countdown Module (CVSS 5.4)
CVE-2024-9538 — ShopLentor <= 2.9.8 - Authenticated (Contributor+) Sensitive Information Exposure via WL: FAQ Widget Elementor Template (CVSS 6.5)
CVE-2024-5530 — ShopLentor – WooCommerce Builder for Elementor & Gutenberg +12 Modules – All in One Solution (formerly WooLentor) <= 2.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via WL Product Horizontal Filter Widget (CVSS 5.4)
CVE-2024-34767 — WordPress ShopLentor plugin <= 2.8.7 - Cross Site Scripting (XSS) vulnerability (CVSS 5.4)
CVE-2024-4566 — ShopLentor <= 2.8.8 - Missing Authorization to WordPress Option Modification (CVSS 7.1)
CVE-2024-3345 — ShopLentor <= 2.8.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via woolentorsearch Shortcode (CVSS 5.4)
CVE-2023-6327 — ShopLentor (formerly WooLentor) <= 2.8.7 - Missing Authorization via purchased_new_products (CVSS 5.3)
CVE-2024-3991 — ShopLentor – WooCommerce Builder for Elementor & Gutenberg +12 Modules – All in One Solution (formerly WooLentor) <= 2.8.7 - Authenticated (contributor+) Stored Cross-Site Scripting via _id (CVSS 5.4)
CVE-2023-7067 — ShopLentor <= 2.8.1 - Improper Authorization via woolentor_template_store (CVSS 4.3)
CVE-2024-1057 — ShopLentor – WooCommerce Builder for Elementor & Gutenberg +10 Modules – All in One Solution (formerly WooLentor) <= 2.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 5.4)
CVE-2024-2946 — ShopLentor – WooCommerce Builder for Elementor & Gutenberg +12 Modules – All in One Solution (formerly WooLentor) <= 2.8.4 - Authenticated (Contributor+) Stored Cross-site Scripting via QR Code Widget (CVSS 5.4)
CVE-2024-1960 — ShopLentor <= 2.8.1 - Authenticated(Contributor+) Stored Cross-Site Scripting via Banner Link (CVSS 5.4)
CVE-2024-2868 — ShopLentor – WooCommerce Builder for Elementor & Gutenberg +12 Modules – All in One Solution (formerly WooLentor) <= 2.8.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via WL Universal Product Layout (CVSS 6.4)
CVE-2023-0232 — ShopLentor < 2.5.4 - PHP Object Injection (CVSS 9.8)