Executive brief
ShopLentor is a WordPress plugin that enhances WooCommerce stores with additional features and widgets. The plugin fails to properly escape user-supplied query parameters in the Product Horizontal Filter widget, allowing attackers to inject malicious JavaScript code. An attacker could trick a store visitor into clicking a crafted link, causing the injected script to execute in the victim's browser and potentially steal session cookies, customer data, or redirect users to malicious sites.
Technical details
The vulnerability is a reflected cross-site scripting (XSS) flaw in the WL: Product Horizontal Filter widget, arising from insufficient input sanitization and output escaping of query-string parameter names. The vulnerable code in wl_product_horizontal_filter.php reflects attacker-controlled URL parameters directly into HTML option element value attributes without proper escaping, allowing an attacker to break out of the value="..." context and inject arbitrary HTML/JavaScript. The attack vector is network-based and requires no authentication; exploitation depends on social engineering (tricking a user into clicking a malicious link). A successful exploit allows arbitrary JavaScript execution in the context of the victim's session. Patches are available in versions later than 3.5.1.
Affected products
- ShopLentor ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin up to and including 3.5.1
Timeline
- 2026-09-18: disclosed