SA
Product
ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin
23
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 1High 3Medium 19Low 0
Watch
Add ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2025-12493 | 9.8 | Nov 4 | ShopLentor <= 3.2.5 - Unauthenticated Local PHP File Inclusion via 'load_template' Affected: through 3.2.5 |
| CVE-2026-1714 | 8.6 | Feb 18 | ShopLentor <= 3.3.2 - Unauthenticated Email Relay Abuse via 'woolentor_suggest_price_action' AJAX Action Affected: through 3.3.2 |
| CVE-2026-6020 | 7.2 | Aug 5 | ShopLentor <= 3.3.7 - Authenticated (Administrator+) Arbitrary Function Execution via 'callback' Parameter via REST API Affected: through 3.3.7 |
| CVE-2024-4566 | 7.1 | May 21 | ShopLentor <= 2.8.8 - Missing Authorization to WordPress Option Modification Affected: through 2.8.8 |
| CVE-2025-3775 | 6.5 | Apr 25 | ShopLentor – WooCommerce Builder for Elementor & Gutenberg +20 Modules – All in One Solution (formerly WooLentor) <= 3.1.2 - Unauthenticated Server-Side Request Forgery via URL Parameter Affected: through 3.1.2 |
| CVE-2024-9538 | 6.5 | Oct 11 | ShopLentor <= 2.9.8 - Authenticated (Contributor+) Sensitive Information Exposure via WL: FAQ Widget Elementor Template Affected: through 2.9.8 |
| CVE-2026-4059 | 6.4 | Apr 14 | ShopLentor <= 3.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'button_text' Shortcode Attribute Affected: through 3.3.5 |
| CVE-2024-2868 | 6.4 | Apr 4 | ShopLentor – WooCommerce Builder for Elementor & Gutenberg +12 Modules – All in One Solution (formerly WooLentor) <= 2.8.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via WL Universal Product Layout Affected: through 2.8.3 |
| CVE-2026-92554 | 6.1 | Sep 18 | ShopLentor <= 3.5.1 - Reflected Cross-Site Scripting via Query-String Parameter Name Affected: through 3.5.1 |
| CVE-2026-6287 | 5.4 | May 27 | ShopLentor - WooCommerce Builder for Elementor & Gutenberg <= 3.3.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Product Grid 'blockUniqId' Block Attribute Affected: through 3.3.8 |
| CVE-2025-11823 | 5.4 | Oct 25 | ShopLentor – WooCommerce Builder for Elementor & Gutenberg +21 Modules – All in One Solution <= 3.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Affected: through 3.2.4 |
| CVE-2025-1527 | 5.4 | Mar 12 | ShopLentor – WooCommerce Builder for Elementor & Gutenberg +20 Modules – All in One Solution (formerly WooLentor) <= 3.1.0 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Flash Sale Countdown Module Affected: through 3.1.0 |
| CVE-2024-8668 | 5.4 | Sep 25 | ShopLentor – WooCommerce Builder for Elementor & Gutenberg +12 Modules – All in One Solution (formerly WooLentor) <= 2.9.7 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting Affected: through 2.9.7 |
| CVE-2024-5530 | 5.4 | Jun 11 | ShopLentor – WooCommerce Builder for Elementor & Gutenberg +12 Modules – All in One Solution (formerly WooLentor) <= 2.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via WL Product Horizontal Filter Widget Affected: through 2.9.0 |
| CVE-2024-3345 | 5.4 | May 21 | ShopLentor <= 2.8.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via woolentorsearch Shortcode Affected: through 2.8.8 |
| CVE-2024-3991 | 5.4 | May 2 | ShopLentor – WooCommerce Builder for Elementor & Gutenberg +12 Modules – All in One Solution (formerly WooLentor) <= 2.8.7 - Authenticated (contributor+) Stored Cross-Site Scripting via _id Affected: through 2.8.7 |
| CVE-2024-1057 | 5.4 | Apr 20 | ShopLentor – WooCommerce Builder for Elementor & Gutenberg +10 Modules – All in One Solution (formerly WooLentor) <= 2.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting Affected: through 2.8.1 |
| CVE-2024-2946 | 5.4 | Apr 9 | ShopLentor – WooCommerce Builder for Elementor & Gutenberg +12 Modules – All in One Solution (formerly WooLentor) <= 2.8.4 - Authenticated (Contributor+) Stored Cross-site Scripting via QR Code Widget Affected: through 2.8.4 |
| CVE-2024-1960 | 5.4 | Apr 9 | ShopLentor <= 2.8.1 - Authenticated(Contributor+) Stored Cross-Site Scripting via Banner Link Affected: through 2.8.1 |
| CVE-2023-6327 | 5.3 | May 9 | ShopLentor (formerly WooLentor) <= 2.8.7 - Missing Authorization via purchased_new_products Affected: through 2.8.7 |
| CVE-2026-16811 | 4.9 | Jul 28 | ShopLentor <= 3.4.5 - Authenticated (Administrator+) SQL Injection via 'orderby' Parameter Affected: through 3.4.5 |
| CVE-2026-16797 | 4.3 | Jul 28 | ShopLentor <= 3.4.5 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Exposure via 'optionSection' Parameter Affected: through 3.4.5 |
| CVE-2023-7067 | 4.3 | May 2 | ShopLentor <= 2.8.1 - Improper Authorization via woolentor_template_store Affected: through 2.8.1 |
Showing 23