Stored Cross-Site Scripting Vulnerability in WooCommerce Builder Plugin by WordPress

CVE-2024-3991

Summary

The ShopLentor plugin for WordPress, specifically the Horizontal Product Filter module, exhibits a stored cross-site scripting vulnerability due to inadequate input sanitization and lack of output escaping. This flaw allows authenticated attackers with contributor-level access or higher to craft malicious web scripts that get executed when users navigate to pages containing the injected scripts. The vulnerability affects all versions of the plugin up to and including 2.8.7, making it critical for site administrators to address this issue to safeguard their websites from potential exploitation.

References