CVE-2026-4059 is a stored cross-site scripting vulnerability in the ShopLentor WordPress plugin, specifically in the woolentor_quickview_button shortcode's button_text attribute. The issue results from improper neutralization of input during web page generation, allowing authenticated users with Contributor or higher privileges to inject malicious scripts. These scripts execute in the context of users who access the injected pages, potentially leading to information disclosure or session hijacking. The vulnerability affects all versions up to 3.3.5. No official fix or patch has been published yet, and no known active exploitation has been reported.

Successful exploitation allows an authenticated user with Contributor-level access or higher to inject and execute arbitrary JavaScript in the context of other users viewing the affected pages. This can lead to information disclosure and user session compromise. The vulnerability does not affect availability and requires user interaction (page access) to trigger the malicious script. The CVSS score of 6.4 reflects a medium severity impact with network attack vector, low attack complexity, and no user interaction required for the script execution once injected.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Contributor-level access to trusted users only and consider disabling or removing the vulnerable shortcode if feasible. Monitor for updates from the vendor and apply patches promptly once released.