ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin

Уязвимости

• CVE-2025-12493без авторизации≤ 3.2.5

  ShopLentor <= 3.2.5 - Unauthenticated Local PHP File Inclusion via 'load_template'

  Критич. 9.8

• CVE-2023-0232без авторизации→ 2.5.4

  ShopLentor < 2.5.4 - PHP Object Injection

  Критич. 9.8

• CVE-2022-47172без авторизации · нужен клик≤ 2.6.2

  WordPress WooLentor Plugin <= 2.6.2 is vulnerable to Cross Site Request Forgery (CSRF)

  Высокий 8.8

• CVE-2026-1714без авторизации≤ 3.3.2

  ShopLentor <= 3.3.2 - Unauthenticated Email Relay Abuse via 'woolentor_suggest_price_action' AJAX Action

  Высокий 8.6

• CVE-2026-6020админ≤ 3.3.7

  ShopLentor <= 3.3.7 - Authenticated (Administrator+) Arbitrary Function Execution via 'callback' Parameter via REST API

  Высокий 7.2

• CVE-2024-4566участник+≤ 2.8.8

  ShopLentor <= 2.8.8 - Missing Authorization to WordPress Option Modification

  Высокий 7.1

• CVE-2025-3775без авторизации≤ 3.1.2

  ShopLentor – WooCommerce Builder for Elementor & Gutenberg +20 Modules – All in One Solution (formerly WooLentor) <= 3.1.2 - Unauthenticated Server-Side Request

  Средний 6.5

• CVE-2024-9538участник+≤ 2.9.8

  ShopLentor <= 2.9.8 - Authenticated (Contributor+) Sensitive Information Exposure via WL: FAQ Widget Elementor Template

  Средний 6.5

• CVE-2026-4059участник+≤ 3.3.5

  ShopLentor <= 3.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'button_text' Shortcode Attribute

  Средний 6.4

• CVE-2024-2868участник+≤ 2.8.3

  ShopLentor – WooCommerce Builder for Elementor & Gutenberg +12 Modules – All in One Solution (formerly WooLentor) <= 2.8.3 - Authenticated (Contributor+) Stored

  Средний 6.4

• CVE-2026-92554без авторизации · нужен клик≤ 3.5.1

  ShopLentor <= 3.5.1 - Reflected Cross-Site Scripting via Query-String Parameter Name

  Средний 6.1

• CVE-2022-46798без авторизации · нужен клик≤ 2.5.1

  WordPress WooLentor Plugin <= 2.5.1 is vulnerable to Cross Site Request Forgery (CSRF)

  Средний 5.4

• CVE-2025-58990нужен вход≤ 3.2.0

  WordPress ShopLentor Plugin <= 3.2.0 - Cross Site Scripting (XSS) Vulnerability

  Средний 5.4

• CVE-2024-34767нужен вход≤ 2.8.7

  WordPress ShopLentor plugin <= 2.8.7 - Cross Site Scripting (XSS) vulnerability

  Средний 5.4

• CVE-2026-6287участник+≤ 3.3.8

  ShopLentor - WooCommerce Builder for Elementor & Gutenberg <= 3.3.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Product Grid 'blockUniqId' Bl

  Средний 5.4

• CVE-2025-11823участник+≤ 3.2.4

  ShopLentor – WooCommerce Builder for Elementor & Gutenberg +21 Modules – All in One Solution <= 3.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting

  Средний 5.4

• CVE-2025-1527участник+≤ 3.1.0

  ShopLentor – WooCommerce Builder for Elementor & Gutenberg +20 Modules – All in One Solution (formerly WooLentor) <= 3.1.0 - Authenticated (Contributor+) Stored

  Средний 5.4

• CVE-2024-8668участник+≤ 2.9.7

  ShopLentor – WooCommerce Builder for Elementor & Gutenberg +12 Modules – All in One Solution (formerly WooLentor) <= 2.9.7 - Authenticated (Contributor+) DOM-Ba

  Средний 5.4

• CVE-2024-5530участник+≤ 2.9.0

  ShopLentor – WooCommerce Builder for Elementor & Gutenberg +12 Modules – All in One Solution (formerly WooLentor) <= 2.9.0 - Authenticated (Contributor+) Stored

  Средний 5.4

• CVE-2024-3345участник+≤ 2.8.8

  ShopLentor <= 2.8.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via woolentorsearch Shortcode

  Средний 5.4

• CVE-2024-3991участник+≤ 2.8.7

  ShopLentor – WooCommerce Builder for Elementor & Gutenberg +12 Modules – All in One Solution (formerly WooLentor) <= 2.8.7 - Authenticated (contributor+) Stored

  Средний 5.4

• CVE-2024-1057участник+≤ 2.8.1

  ShopLentor – WooCommerce Builder for Elementor & Gutenberg +10 Modules – All in One Solution (formerly WooLentor) <= 2.8.1 - Authenticated (Contributor+) Stored

  Средний 5.4

• CVE-2024-2946участник+≤ 2.8.4

  ShopLentor – WooCommerce Builder for Elementor & Gutenberg +12 Modules – All in One Solution (formerly WooLentor) <= 2.8.4 - Authenticated (Contributor+) Stored

  Средний 5.4

• CVE-2024-1960участник+≤ 2.8.1

  ShopLentor <= 2.8.1 - Authenticated(Contributor+) Stored Cross-Site Scripting via Banner Link

  Средний 5.4

• CVE-2023-6327без авторизации≤ 2.8.7

  ShopLentor (formerly WooLentor) <= 2.8.7 - Missing Authorization via purchased_new_products

  Средний 5.3

• CVE-2026-16811админ≤ 3.4.5

  ShopLentor <= 3.4.5 - Authenticated (Administrator+) SQL Injection via 'orderby' Parameter

  Средний 4.9

• CVE-2026-16797участник+≤ 3.4.5

  ShopLentor <= 3.4.5 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Exposure via 'optionSection' Parameter

  Средний 4.3

• CVE-2023-7067участник+≤ 2.8.1

  ShopLentor <= 2.8.1 - Improper Authorization via woolentor_template_store

  Средний 4.3