Shoplentor
Approved changes feed: RSS · Atom
cpe:2.3:a:hasthemes:shoplentor:*:*:*:*:*:wordpress:*:*
part: a version: * update: *
| Vendor | Hasthemes (d368bab3-bc4f-5819-9d32-f6fb06c04453) |
|---|---|
| Product | Shoplentor (3a7bc79e-a590-5f61-adbe-98fb646a34e0) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | wordpress |
| Target hardware | * |
| Other | * |
| Notes | Imported from purl2cpe mapping |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/elementor/elementor |
purl2cpe | 2026-06-01 10:17:01.852247 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2025-58990 |
vulnerable | 2026-06-08 07:35:19.858609 |
WordPress ShopLentor Plugin <= 3.2.0 - Cross Site Scripting (XSS) Vulnerability
MEDIUM (6.5)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DevItems ShopLentor woolentor-addons allows Stored XSS.This issue affects ShopLentor: from n/a through <= 3.2.0.
Published: 2025-09-09T16:33:07.863Z
Updated: 2026-04-28T16:13:50.905Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-3775 |
vulnerable | 2026-06-08 07:23:09.871463 |
ShopLentor – WooCommerce Builder for Elementor & Gutenberg +20 Modules – All in One Solution (formerly WooLentor) <= 3.1.2 - Unauthenticated Server-Side Request Forgery via URL Parameter
MEDIUM (6.5)
The ShopLentor – WooCommerce Builder for Elementor & Gutenberg +20 Modules – All in One Solution (formerly WooLentor) plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 3.1.2 via the woolentor_template_proxy function. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application, and can be used to query and modify information from internal services.
Published: 2025-04-25T04:23:04.940Z
Updated: 2026-04-08T16:51:38.675Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-1527 |
vulnerable | 2026-06-08 07:08:37.188192 |
ShopLentor – WooCommerce Builder for Elementor & Gutenberg +20 Modules – All in One Solution (formerly WooLentor) <= 3.1.0 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Flash Sale Countdown Module
MEDIUM (6.4)
The ShopLentor – WooCommerce Builder for Elementor & Gutenberg +20 Modules – All in One Solution (formerly WooLentor) plugin for WordPress is vulnerable to a Stored DOM-Based Cross-Site Scripting via the plugin's Flash Sale Countdown module in all versions up to, and including, 3.1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Published: 2025-03-12T11:13:32.596Z
Updated: 2026-04-08T17:25:32.681Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-12493 |
vulnerable | 2026-06-08 07:04:30.321897 |
ShopLentor <= 3.2.5 - Unauthenticated Local PHP File Inclusion via 'load_template'
CRITICAL (9.8)
The ShopLentor – WooCommerce Builder for Elementor & Gutenberg +21 Modules – All in One Solution (formerly WooLentor) plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.2.5 via the 'load_template' function. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included.
Published: 2025-11-04T11:19:27.403Z
Updated: 2026-04-08T16:36:30.320Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-11823 |
vulnerable | 2026-06-08 07:04:29.001674 |
ShopLentor – WooCommerce Builder for Elementor & Gutenberg +21 Modules – All in One Solution <= 3.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
MEDIUM (6.4)
The ShopLentor – WooCommerce Builder for Elementor & Gutenberg +21 Modules – All in One Solution plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'button_exist_text' parameter in the 'wishsuite_button' shortcode in all versions up to, and including, 3.2.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Published: 2025-10-25T04:22:44.973Z
Updated: 2026-04-08T16:44:09.355Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-9538 |
vulnerable | 2026-06-08 07:00:28.143883 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-5530 |
vulnerable | 2026-06-08 06:56:16.265130 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-4566 |
vulnerable | 2026-06-08 06:50:18.170056 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-3991 |
vulnerable | 2026-06-08 06:43:52.060978 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-3345 |
vulnerable | 2026-06-08 06:41:52.992079 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-34767 |
vulnerable | 2026-06-08 06:37:34.992742 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-2946 |
vulnerable | 2026-06-08 06:35:27.771016 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-2868 |
vulnerable | 2026-06-08 06:35:27.564091 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-1960 |
vulnerable | 2026-06-08 06:27:15.133916 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-1057 |
vulnerable | 2026-06-08 06:25:39.098627 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-7067 |
vulnerable | 2026-06-08 06:21:56.897552 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-6327 |
vulnerable | 2026-06-08 06:19:46.964682 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-0232 |
vulnerable | 2026-06-08 05:52:04.572213 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-0231 |
vulnerable | 2026-06-08 05:52:04.571762 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.