CVE-2026-4059: ShopLentor WordPress Plugin XSS Vulnerability

CVE-2026-4059 Overview

The ShopLentor plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) via the woolentor_quickview_button shortcode's button_text attribute in all versions up to, and including, 3.3.5. This vulnerability exists due to insufficient input sanitization and missing output escaping on user-supplied shortcode attributes. Authenticated attackers with Contributor-level access and above can inject arbitrary web scripts into pages that will execute whenever a user accesses an injected page.

Critical Impact

Authenticated attackers can inject persistent malicious scripts that execute in victims' browsers, potentially leading to session hijacking, credential theft, or defacement of WordPress sites running vulnerable versions of ShopLentor.

Affected Products

• ShopLentor (WooLentor) WordPress Plugin versions up to and including 3.3.5
• WordPress installations using the vulnerable woolentor_quickview_button shortcode
• WooCommerce stores utilizing ShopLentor's quickview functionality

Discovery Timeline

• 2026-04-14 - CVE CVE-2026-4059 published to NVD
• 2026-04-14 - Last updated in NVD database

Technical Details for CVE-2026-4059

Vulnerability Analysis

This Stored Cross-Site Scripting vulnerability affects the ShopLentor WordPress plugin's quickview button shortcode functionality. The flaw resides in the Shortcode.php file within the quickview module, specifically in how the button_text attribute is processed and rendered.

The vulnerability stems from the plugin's failure to properly sanitize input data and escape output when handling shortcode attributes. When a user with at least Contributor-level privileges creates or edits content containing the woolentor_quickview_button shortcode, they can inject malicious JavaScript code through the button_text parameter. This code is stored in the WordPress database and subsequently executed in the browsers of any user who views the affected page.

The attack requires authentication with at least Contributor privileges, which limits the attack surface somewhat. However, many WordPress installations grant Contributor access to multiple users, and compromised Contributor accounts could be leveraged to exploit this vulnerability.

Root Cause

The root cause of this vulnerability is the absence of proper input sanitization and output escaping in the shortcode handler. The button_text attribute passed to the woolentor_quickview_button shortcode is rendered directly into the HTML output without adequate filtering or encoding, allowing HTML and JavaScript injection.

The vulnerable code path flows through Shortcode.php (line 61) and is rendered via the quickview-button.php template file. The lack of WordPress security functions such as esc_html(), esc_attr(), or wp_kses() when outputting user-supplied data creates the XSS condition.

Attack Vector

The attack is executed over the network and requires low privileges (Contributor-level access or above). An attacker can exploit this vulnerability by:

1. Authenticating to the WordPress site with at least Contributor privileges
2. Creating or editing a post/page containing the woolentor_quickview_button shortcode
3. Injecting malicious JavaScript through the button_text attribute
4. Publishing or submitting the content for review

Once the malicious content is published or previewed, any user viewing the page will have the injected script execute in their browser context. This can lead to session token theft, account takeover, phishing attacks, or further exploitation of the WordPress installation.

The malicious payload persists in the database, making this a stored XSS attack that can affect multiple victims over time. For detailed technical analysis, refer to the Wordfence Vulnerability Analysis.

Detection Methods for CVE-2026-4059

Indicators of Compromise

• Presence of suspicious JavaScript code or HTML tags within the button_text attribute of woolentor_quickview_button shortcodes in post content
• Unexpected script tags or event handlers (such as onload, onerror, onclick) in quickview button elements
• Browser console errors or warnings related to Content Security Policy violations on pages using quickview buttons
• Reports from users experiencing unexpected redirects, pop-ups, or prompts when viewing product pages

Detection Strategies

• Review WordPress database (wp_posts table) for posts containing woolentor_quickview_button shortcodes with suspicious button_text values containing script tags or event handlers
• Implement Content Security Policy headers to detect and block inline script execution, which would generate violation reports when XSS payloads attempt to execute
• Monitor web application firewall logs for XSS patterns in POST requests to the WordPress editor endpoints
• Use WordPress security plugins to scan for malicious content patterns in stored post data

Monitoring Recommendations

• Enable and review WordPress audit logs to track changes made to posts by Contributor-level users
• Deploy browser-based monitoring or Real User Monitoring (RUM) to detect unexpected JavaScript execution patterns
• Configure alerting on Content Security Policy violation reports to identify attempted XSS exploitation
• Regularly audit user accounts with Contributor or higher privileges to ensure principle of least privilege

How to Mitigate CVE-2026-4059

Immediate Actions Required

• Update ShopLentor (WooLentor) plugin to version 3.3.6 or later immediately
• Audit existing posts and pages containing woolentor_quickview_button shortcodes for malicious payloads
• Review user accounts with Contributor-level access or above and revoke unnecessary privileges
• Consider temporarily disabling the quickview button feature if immediate patching is not possible

Patch Information

The vulnerability has been addressed in ShopLentor version 3.3.6. The fix implements proper output escaping for the button_text shortcode attribute. Site administrators should update to this version or later as soon as possible.

The patch changeset can be reviewed at the WordPress Plugin Changeset. Additionally, the version comparison between 3.3.5 and 3.3.6 is available at the WordPress Plugin Version Changes page. Wordfence also provides a patch download for users who need offline patching capabilities.

Workarounds

• Restrict Contributor-level access by limiting the number of users with shortcode creation capabilities until the patch is applied
• Implement a Content Security Policy header with strict script-src directives to prevent inline script execution
• Use a Web Application Firewall (WAF) with rules to filter XSS patterns in WordPress shortcode attributes
• Temporarily disable the ShopLentor quickview module if the functionality is not essential for business operations

# Example: Add CSP header to WordPress via .htaccess (Apache)
# Add to .htaccess in WordPress root directory
<IfModule mod_headers.c>
    Header set Content-Security-Policy "script-src 'self' https://trusted-cdn.com; object-src 'none';"
</IfModule>