{"id":"CVE-2026-125733","kind":"vulnerability","aliases":["CVE-2026-125733"],"related":[],"title":"ShopLentor WooCommerce addon: reflected XSS lets attackers run scripts in visitors' browsers","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DevItems ShopLentor woolentor-addons allows Reflected XSS.This issue affects ShopLentor: from n/a through 3.5.7.","summary":"ShopLentor (woolentor-addons), a WordPress plugin for WooCommerce stores, fails to neutralize input in generated pages, enabling reflected cross-site scripting. An attacker who gets a victim to open a crafted link can run script in the victim's browser on the store's site.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"woolentor-addons","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["package","shoplentor","woocommerce","woolentor-addons","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed version of the ShopLentor / woolentor-addons plugin in the WordPress admin under Plugins.","fix":"- ShopLentor through `3.5.7` is affected; the sources do not state a fixed version.","status":"open","published_at":"2026-11-15T15:16:46+00:00","first_seen_at":"2026-11-15T15:36:07+00:00","triaged_at":"2026-11-15T15:37:14+00:00","updated_at":"2026-11-15T15:37:14+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-15T15:37:14Z","model":"claude-haiku-5-5","output":{"fix":"- ShopLentor through `3.5.7` is affected; the sources do not state a fixed version.","reach":"internet","title":"ShopLentor WooCommerce addon: reflected XSS lets attackers run scripts in visitors' browsers","impact":"medium","summary":"ShopLentor (woolentor-addons), a WordPress plugin for WooCommerce stores, fails to neutralize input in generated pages, enabling reflected cross-site scripting. An attacker who gets a victim to open a crafted link can run script in the victim's browser on the store's site.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","woocommerce","shoplentor","woolentor-addons"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Attacker runs scripts in visitors' browsers, stealing sessions or payment data","analyst_note":"Find the fixed version and the vulnerable parameter from the NVD entry and the vendor's advisory; the sources list no fix.","how_to_check":"- Check the installed version of the ShopLentor / woolentor-addons plugin in the WordPress admin under Plugins.\n- unknown for other checks; the sources do not say.","plain_action":"","product_name":"woolentor-addons","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the ShopLentor (woolentor-addons) WordPress plugin at version 3.5.7 or earlier are affected. The sources do not say which settings or pages are required to trigger the flaw, so unknown whether only specific pages are exposed.","user_interaction":"yes","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000764,"input_tokens":4545,"output_tokens":619,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-125733':15A,18A '-2026':14A,17A '3.5.7':104C 'addon':3A,27B,32B,94C 'addons':21A 'affect':99C 'allow':95C 'attack':7A,53B 'browser':12A,70B 'craft':61B 'cross':49B,85C 'cross-sit':48B,84C 'cve':13A,16A 'devitem':90C 'enabl':46B 'fail':39B 'generat':44B,83C 'get':55B 'improp':76C 'input':42B,79C 'issu':98C 'let':6A 'link':62B 'n/a':102C 'neutral':41B,77C 'open':59B 'packag':22B 'page':45B,82C 'plugin':35B 'reflect':4A,47B,96C 'run':8A,64B 'script':9A,51B,65B,87C 'shoplentor':1A,23B,29B,91C,100C 'site':50B,75B,86C 'store':38B,73B 'victim':57B,68B 'visitor':11A 'vulner':88C 'web':81C 'woocommerc':2A,24B,37B 'woolentor':20A,26B,31B,93C 'woolentor-addon':25B,30B,92C 'woolentor-addons':19A 'wordpress':28B,34B 'xss':5A 'xss.this':97C","nicknames":[],"mitigations":[],"who_affected":"Sites running the ShopLentor (woolentor-addons) WordPress plugin at version 3.5.7 or earlier are affected. The sources do not say which settings or pages are required to trigger the flaw, so unknown whether only specific pages are exposed.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":["woolentoraddons"],"ptokens":["addons","woolentor"],"labels":["high","package","shoplentor","vendor","woocommerce","woolentoraddons","wordpress"],"campaign_type":null,"search_a":"'-125733':15A,18A '-2026':14A,17A 'addon':3A 'addons':21A 'attack':7A 'browser':12A 'cve':13A,16A 'let':6A 'reflect':4A 'run':8A 'script':9A 'shoplentor':1A 'visitor':11A 'woocommerc':2A 'woolentor':20A 'woolentor-addons':19A 'xss':5A","search_b":"'addon':27B,32B 'attack':53B 'browser':70B 'craft':61B 'cross':49B 'cross-sit':48B 'enabl':46B 'fail':39B 'generat':44B 'get':55B 'input':42B 'link':62B 'neutral':41B 'open':59B 'packag':22B 'page':45B 'plugin':35B 'reflect':47B 'run':64B 'script':51B,65B 'shoplentor':23B,29B 'site':50B,75B 'store':38B,73B 'victim':57B,68B 'woocommerc':24B,37B 'woolentor':26B,31B 'woolentor-addon':25B,30B 'wordpress':28B,34B","search_c":"'3.5.7':104C 'addon':94C 'affect':99C 'allow':95C 'cross':85C 'cross-sit':84C 'devitem':90C 'generat':83C 'improp':76C 'input':79C 'issu':98C 'n/a':102C 'neutral':77C 'page':82C 'reflect':96C 'script':87C 'shoplentor':91C,100C 'site':86C 'vulner':88C 'web':81C 'woolentor':93C 'woolentor-addon':92C 'xss.this':97C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-15T15:16:46+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125733","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125733","severity":null,"published_at":"2026-11-15T15:16:46+00:00","modified_at":"2026-11-15T15:16:46+00:00","first_seen_at":"2026-11-15T15:36:07+00:00","fetched_at":"2026-11-15T15:36:07+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}