The ShopLentor - WooCommerce Builder for Elementor & Gutenberg plugin for WordPress suffers from a stored cross-site scripting vulnerability identified as CVE-2026-6287. This vulnerability is due to improper neutralization of input during web page generation (CWE-79) specifically in the 'blockUniqId' block attribute of multiple Product Grid blocks. Authenticated attackers with contributor-level permissions or higher can inject arbitrary web scripts that persist and execute in the context of users visiting the affected pages. The vulnerability affects versions up to 3.3.8. The CVSS 3.1 base score is 5.4, reflecting a medium impact with network attack vector, low attack complexity, privileges required, and user interaction needed. No vendor advisory or patch information is currently available.

Successful exploitation allows an authenticated user with contributor-level access or higher to inject persistent malicious scripts into pages generated by the plugin. These scripts execute in the context of users who view the infected pages, potentially leading to information disclosure or limited integrity impact. The vulnerability does not affect availability. There are no known active exploits in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, limit contributor-level access to trusted users only and consider disabling or restricting use of the affected Product Grid blocks. Monitor for updates from the vendor devitemsllc regarding patches or official mitigations.