CVE-2026-92554: ShopLentor <= 3.5.1 - Reflected Cross-Site Scripting via Query-String Parameter Name
The ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via Query-String Parameter Name in all versions up to, and including, 3.5.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. The vulnerability is triggered via the WL: Product Horizontal Filter widget, which reflects attacker-supplied query-string parameter names from the current URL into option element value attributes without escaping, allowing payload breakout from the value="..." attribute context.
Affected Software
Event History
Frequently Asked Questions
Which pages are exposed to this issue?
Pages that use the WL: Product Horizontal Filter widget are exposed, because the widget reflects query-string parameter names from the current URL into option element value attributes.
Does an attacker need a WordPress account or other authentication?
No. The issue can be exploited by an unauthenticated attacker, but they must convince a user to perform an action such as clicking a crafted link.
Which installations are affected?
All versions up to and including 3.5.1 are affected. The issue is relevant where the affected widget is present on a page that a targeted user can visit.