CVE-2026-92554: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in devitemsllc ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin
ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin for WordPress versions up to 3.5.1 are vulnerable to reflected cross-site scripting (XSS) via a query-string parameter. The vulnerability arises from insufficient input sanitization and output escaping in the WL: Product Horizontal Filter widget, allowing attacker-supplied input to be reflected in HTML attribute values. This can enable unauthenticated attackers to inject arbitrary scripts that execute when a user interacts with a crafted link.
AI Analysis
Technical Summary
CVE-2026-92554 is a reflected cross-site scripting vulnerability in the ShopLentor plugin for WordPress, affecting all versions up to and including 3.5.1. The flaw exists because the WL: Product Horizontal Filter widget reflects query-string parameter names into option element value attributes without proper escaping, allowing an attacker to inject malicious scripts. Exploitation requires tricking a user into clicking a crafted link, leading to script execution in the user's browser context.
Potential Impact
Successful exploitation can lead to partial compromise of user confidentiality and integrity via script injection, such as stealing cookies or performing actions on behalf of the user. The CVSS score of 6.1 (medium severity) reflects the network attack vector, no privileges required, user interaction needed, and impact on confidentiality and integrity but not availability.
Mitigation Recommendations
No official patch or fix is currently documented. Users should monitor the vendor's advisory for updates. Until a fix is available, avoid using untrusted query parameters with the WL: Product Horizontal Filter widget and consider disabling or removing this widget if possible to reduce exposure.
CVE-2026-92554: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in devitemsllc ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin
Description
ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin for WordPress versions up to 3.5.1 are vulnerable to reflected cross-site scripting (XSS) via a query-string parameter. The vulnerability arises from insufficient input sanitization and output escaping in the WL: Product Horizontal Filter widget, allowing attacker-supplied input to be reflected in HTML attribute values. This can enable unauthenticated attackers to inject arbitrary scripts that execute when a user interacts with a crafted link.
CVSS v3.1
Score 6.1medium
Affected software
devitemsllc
ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-92554 is a reflected cross-site scripting vulnerability in the ShopLentor plugin for WordPress, affecting all versions up to and including 3.5.1. The flaw exists because the WL: Product Horizontal Filter widget reflects query-string parameter names into option element value attributes without proper escaping, allowing an attacker to inject malicious scripts. Exploitation requires tricking a user into clicking a crafted link, leading to script execution in the user's browser context.
Potential Impact
Successful exploitation can lead to partial compromise of user confidentiality and integrity via script injection, such as stealing cookies or performing actions on behalf of the user. The CVSS score of 6.1 (medium severity) reflects the network attack vector, no privileges required, user interaction needed, and impact on confidentiality and integrity but not availability.
Mitigation Recommendations
No official patch or fix is currently documented. Users should monitor the vendor's advisory for updates. Until a fix is available, avoid using untrusted query parameters with the WL: Product Horizontal Filter widget and consider disabling or removing this widget if possible to reduce exposure.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- Wordfence
- Date Reserved
- 2026-09-16T13:13:51.518Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6aacec8855bf5e2cf5b113ef
Added to database: 09/18/2026, 07:47:20 UTC
Last enriched: 09/18/2026, 08:01:58 UTC
Last updated: 09/18/2026, 17:51:39 UTC
Views: 8
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.