The ShopLentor WordPress plugin (formerly WooLentor) contains a stored cross-site scripting vulnerability (CWE-79) in the Special Offer Day Widget Banner Link component. This vulnerability allows authenticated users with contributor-level or higher permissions to inject arbitrary web scripts due to improper neutralization of input during web page generation. The injected scripts execute in the context of users who visit the compromised pages. The vulnerability affects all versions up to 2.8.1. The CVSS 3.1 base score is 6.4 (medium severity), with network attack vector, low attack complexity, privileges required at the contributor level, no user interaction needed, and impacts confidentiality and integrity with no availability impact. No patch or official remediation guidance is currently documented in the provided data.

An attacker with contributor-level or higher permissions can exploit this vulnerability to inject malicious scripts that execute in the browsers of users who view the affected pages. This can lead to unauthorized actions performed on behalf of users, disclosure of sensitive information, or session hijacking. The impact affects confidentiality and integrity but does not affect availability. Since the vulnerability requires authenticated access at contributor level, the risk is limited to environments where such user roles exist.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level permissions to trusted users only and consider disabling or removing the Special Offer Day Widget Banner Link feature if feasible. Monitor for updates from devitemsllc regarding patches or security updates for ShopLentor. No vendor advisory or patch links are currently provided.