CVE-2025-58990 Overview
CVE-2025-58990 is a stored Cross-Site Scripting (XSS) vulnerability in the DevItems ShopLentor plugin (also known as woolentor-addons) for WordPress. The flaw affects all versions up to and including 3.2.0. An authenticated user with low privileges can inject malicious script payloads that persist in the application and execute in the browsers of other users who view the affected page. The vulnerability is tracked under CWE-79 and documented in the Patchstack Vulnerability Report.
Critical Impact
Attackers with low-privilege authenticated access can store malicious JavaScript that executes in other users' sessions, enabling session theft, defacement, and administrative action hijacking on WordPress sites running ShopLentor through 3.2.0.
Affected Products
- Hasthemes ShopLentor (woolentor-addons) WordPress plugin, versions through 3.2.0
- WordPress sites using ShopLentor as a WooCommerce builder add-on
- Any multi-user WordPress deployment where contributors or editors can author plugin-rendered content
Discovery Timeline
- 2025-09-09 - CVE-2025-58990 published to the National Vulnerability Database
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-58990
Vulnerability Analysis
The vulnerability stems from improper neutralization of user-supplied input during web page generation inside ShopLentor's widget or settings handlers. Input provided by an authenticated contributor-level or higher user is stored in the database and later rendered in the DOM without proper encoding or sanitization. When a victim loads a page containing the injected content, the browser executes the attacker-controlled JavaScript in the context of the WordPress site origin.
Because the issue is stored rather than reflected, exploitation does not require social engineering per request. A single successful injection remains active until an administrator removes it. The payload runs with the privileges of whichever user views the page, which can include site administrators browsing the WordPress dashboard.
Root Cause
ShopLentor fails to apply output escaping functions such as esc_html(), esc_attr(), or wp_kses_post() to specific input fields handled by the plugin. Combined with insufficient server-side input validation, this allows HTML and script content to be persisted and rendered verbatim.
Attack Vector
Exploitation requires network access, low-level authenticated privileges, and user interaction from a victim who loads the injected content. The attacker submits a crafted payload containing HTML or JavaScript through a vulnerable ShopLentor input. The scope is changed because the executing script can act against resources beyond the vulnerable component, including the WordPress admin interface. See the Patchstack advisory for additional technical context.
Detection Methods for CVE-2025-58990
Indicators of Compromise
- Unexpected <script>, <iframe>, or event-handler attributes (onerror, onload, onmouseover) stored in wp_postmeta or wp_options rows associated with ShopLentor
- Outbound requests from administrator browsers to unfamiliar domains shortly after loading pages or widgets rendered by ShopLentor
- New or modified WordPress administrator accounts created without a corresponding legitimate admin session
Detection Strategies
- Audit ShopLentor-managed widget settings and post meta for HTML tags and JavaScript event handlers using WP-CLI or direct database queries
- Review web server access logs for POST requests to admin-ajax.php or ShopLentor REST endpoints originating from contributor or author accounts
- Monitor for Content Security Policy (CSP) violation reports indicating inline script execution on pages built with ShopLentor
Monitoring Recommendations
- Enable WordPress audit logging to capture content changes by low-privilege users and correlate with ShopLentor plugin activity
- Forward WordPress and web server telemetry to a centralized analytics platform to identify anomalous script content in stored fields
- Alert on administrator session activity following page loads of content authored by non-administrator users
How to Mitigate CVE-2025-58990
Immediate Actions Required
- Update ShopLentor (woolentor-addons) to a version newer than 3.2.0 as soon as the vendor publishes a fixed release
- Review all existing ShopLentor widgets, templates, and settings for previously injected payloads and remove any suspicious HTML or script content
- Restrict contributor, author, and editor accounts to trusted users and rotate credentials for any account suspected of compromise
Patch Information
Refer to the Patchstack advisory for ShopLentor for the current fixed version and release notes. Apply the vendor patch through the WordPress plugin updater or by replacing the plugin directory with the patched release.
Workarounds
- Temporarily disable the ShopLentor plugin on sites that do not require it until a patched version is installed
- Enforce a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins
- Deploy a web application firewall rule to filter HTML tags and JavaScript event handlers submitted to ShopLentor endpoints
- Limit who can publish or edit content by revoking unneeded edit_posts and publish_posts capabilities from untrusted roles
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
