CVE-2026-85575: The ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution with eCommerce Templates & Woo Widgets <= 4.9.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'shopengine_product_title_header_size' Parameter
The ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution with eCommerce Templates & Woo Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘shopengineproducttitleheadersize’ parameter in all versions up to, and including, 4.9.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected Software
Event History
Frequently Asked Questions
Does a Contributor account have enough access to exploit this issue?
The available data is inconsistent: the title labels the issue as Contributor+, while the description specifically states Author-level access and above. Treat Author and higher roles as confirmed exposure; the data does not confirm exploitability for Contributor-only accounts.
Which installed versions should be considered affected?
All versions up to and including 4.9.5 are identified as affected. The provided data does not identify a fixed version.
What evidence could indicate attempted or successful exploitation?
Review pages created or edited by Author-level and higher users for unexpected script content associated with the shopengine_product_title_header_size parameter. The supplied data does not provide a specific payload, log signature, or indicator of compromise.