Stored Cross-Site Scripting Vulnerability in WooCommerce Builder Plugin by WordPress
CVE-2024-3991
6.4MEDIUM
Key Information:
- Vendor
Wordpress
- Vendor
- CVE Published:
- 2 May 2024
What is CVE-2024-3991?
The ShopLentor plugin for WordPress, specifically the Horizontal Product Filter module, exhibits a stored cross-site scripting vulnerability due to inadequate input sanitization and lack of output escaping. This flaw allows authenticated attackers with contributor-level access or higher to craft malicious web scripts that get executed when users navigate to pages containing the injected scripts. The vulnerability affects all versions of the plugin up to and including 2.8.7, making it critical for site administrators to address this issue to safeguard their websites from potential exploitation.
Affected Version(s)
ShopLentor – WooCommerce Builder for Elementor & Gutenberg +12 Modules – All in One Solution (formerly WooLentor) * <= 2.8.7