WordPress plugin
ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin security & vulnerabilities
No known unpatched vulnerabilities in the latest version
All 30 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.
- Critical2
- High3
- Medium25
- Low0
All ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin vulnerabilities
- Medium6.1Reflected Cross-Site Scripting via Query-String Parameter Name
≤3.5.1Update to 3.5.2
- High7.2Authenticated (Administrator+) Arbitrary Function Execution via 'callback' Parameter via REST API
≤3.3.7Update to 3.3.8
- Medium4.3Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Exposure via 'optionSection' Parameter
≤3.4.5Update to 3.4.6
- Medium4.9Authenticated (Administrator+) SQL Injection via 'orderby' Parameter
≤3.4.5Update to 3.4.6
- Medium5.4WooCommerce Builder for Elementor & Gutenberg <= 3.3.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Product Grid 'blockUniqId' Block Attribute
≤3.3.8Update to 3.3.9
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'button_text' Shortcode Attribute
≤3.3.5Update to 3.3.6
- High8.6Unauthenticated Email Relay Abuse via 'woolentor_suggest_price_action' AJAX Action
≤3.3.2Update to 3.3.3
- Critical9.8Unauthenticated Local PHP File Inclusion via 'load_template'
≤3.2.5Update to 3.2.6
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
≤3.2.4Update to 3.2.5
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤3.2.0Update to 3.2.1
- Medium6.5Unauthenticated Server-Side Request Forgery via URL Parameter
≤3.1.2Update to 3.1.3
- Medium6.4Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Flash Sale Countdown Module
≤3.1.0Update to 3.1.1
- Medium4.3Authenticated (Contributor+) Sensitive Information Exposure via WL: FAQ Widget Elementor Template
≤2.9.8Update to 2.9.9
- Medium6.4Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting
≤2.9.7Update to 2.9.8
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via WL Product Horizontal Filter Widget
≤2.9.0Update to 2.9.1
- High7.1Missing Authorization to WordPress Option Modification
≤2.8.8Update to 2.8.9
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via woolentorsearch Shortcode
≤2.8.8Update to 2.8.9
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤2.8.7Update to 2.8.8
- Medium5.3Missing Authorization via purchased_new_products
≤2.8.7Update to 2.8.8
- Medium6.4Authenticated (contributor+) Stored Cross-Site Scripting via _id
≤2.8.7Update to 2.8.8
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤2.8.1Update to 2.8.2
- Medium4.3Improper Authorization via woolentor_template_store
≤2.8.1Update to 2.8.2
- Medium6.4Authenticated (Contributor+) Stored Cross-site Scripting via QR Code Widget
≤2.8.4Update to 2.8.5
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via WL Universal Product Layout
≤2.8.3Update to 2.8.4
- Medium6.4Authenticated(Contributor+) Stored Cross-Site Scripting via Banner Link
≤2.8.1Update to 2.8.2
- Medium4.3Cross-Site Request Forgery via process_data
≤2.6.2Update to 2.6.3
- Medium5.4Cross-Site Request Forgery to Post Updates
≤2.5.1Update to 2.5.2
- Critical9.8PHP Object Injection
≤2.5.3Update to 2.5.4
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
≤2.5.3Update to 2.5.4
- Medium6.4Authenticated Stored Cross-Site Scripting
<1.8.6Update to 1.8.6
ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin: common questions
Does ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin have known vulnerabilities?
Yes. VulnCrest Radar lists 30 known vulnerabilities in ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin: 2 critical, 3 high, 25 medium. None are known to affect version null.
How do I check which version of ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin vulnerability?
CVE-2026-92554, published Sep 17, 2026: ShopLentor <= 3.5.1 - Reflected Cross-Site Scripting via Query-String Parameter Name. Severity: Medium (CVSS 6.1).
Is any ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin vulnerability listed in CISA KEV?
No. None of the known ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin vulnerabilities is currently listed in the CISA KEV catalog.