CVE-2026-125733
Deferred Deferred - Pending Action

Cross-Site Scripting in ShopLentor woolentor-addons

Publication date: 2026-11-15

Last updated on: 2026-11-15

Assigner: Patchstack

Description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DevItems ShopLentor woolentor-addons allows Reflected XSS.This issue affects ShopLentor: from n/a through 3.5.7.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-15
Last Modified
2026-11-15
Generated
2026-11-15
AI Q&A
2026-11-15
EPSS Evaluated
N/A
NVD
CVE-2026-125733
EUVD
EUVD-2026-126089

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
devitems shoplentor to 3.5.7 (inc)
devitems shoplentor From 3.0.0 (inc) to 3.5.7 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Reflected Cross-site Scripting (XSS) vulnerability in the DevItems ShopLentor woolentor-addons WordPress plugin. It allows attackers to inject malicious scripts into web pages by exploiting improper input neutralization during page generation. The flaw exists in versions up to 3.5.7.

Detection Guidance

Detecting this XSS vulnerability requires checking the ShopLentor plugin version. Use WordPress admin dashboard to verify the plugin version or run SQL query on the database: SELECT * FROM wp_options WHERE option_name LIKE '%shoplentor%';. Alternatively, use WP-CLI: wp plugin list | grep ShopLentor.

Impact Analysis

Attackers could steal visitor data, hijack user accounts, or perform unauthorized actions on your website. The vulnerability requires user interaction like clicking a malicious link or submitting a form to trigger. It poses a moderate risk with a CVSS score of 7.1.

Compliance Impact

This reflected XSS vulnerability could allow attackers to steal sensitive user data, such as session cookies or personal information, which may violate GDPR and HIPAA compliance requirements for data protection and privacy.

Mitigation Strategies

Immediately update ShopLentor to version 3.5.8 or higher. If updating is not possible, apply a mitigation rule from Patchstack to block attacks until the update is completed. Disable the plugin temporarily if no immediate fix is available.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-125733. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...