Cross-Site Scripting Flaw in DevItems ShopLentor for WordPress
CVE-2026-125733

7.1HIGH

Key Information:

Vendor

WordPress
Status
Shoplentor
Vendor
CVE Published:
15 November 2026

What is CVE-2026-125733?

The DevItems ShopLentor plugin has a Cross-Site Scripting (XSS) vulnerability caused by improper handling of user inputs during web page generation. This security issue allows attackers to inject malicious scripts that can be executed in the user's browser, leading to potential data theft or unauthorized access. The vulnerability affects versions up to 3.5.7, compromising the safety of websites utilizing this plugin.

Affected Version(s)

ShopLentor 0 <= 3.5.7

References

https://patchstack.com/database/wordpress/plugin/woolento...
vdb-entry

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

AndrewN | Patchstack Bug Bounty Program
.