CVE-2026-6287 Overview
CVE-2026-6287 is a Stored Cross-Site Scripting (XSS) vulnerability in the ShopLentor - WooCommerce Builder for Elementor & Gutenberg plugin for WordPress. The flaw affects all versions up to and including 3.3.8. It exists in the blockUniqId block attribute used across multiple Product Grid blocks. Authenticated users with contributor-level access or higher can inject arbitrary JavaScript that executes when a visitor views the affected page. The root weakness is classified as [CWE-79] Improper Neutralization of Input During Web Page Generation.
Critical Impact
Authenticated contributors can inject persistent JavaScript that executes in the browser of any user viewing the compromised page, enabling session theft, account takeover, and administrative action abuse.
Affected Products
- ShopLentor - WooCommerce Builder for Elementor & Gutenberg plugin for WordPress
- All versions up to and including 3.3.8
- Sites permitting contributor-level or higher registration
Discovery Timeline
- 2026-05-27 - CVE-2026-6287 published to NVD
- 2026-05-27 - Last updated in NVD database
Technical Details for CVE-2026-6287
Vulnerability Analysis
The vulnerability resides in how ShopLentor processes the blockUniqId attribute on multiple Product Grid blocks. The plugin accepts the attribute value from authenticated users editing posts or pages but fails to sanitize the input on storage or escape it on output. When the block renders, the attacker-controlled value is reflected into the HTML response without encoding. This allows arbitrary script content to execute in the context of the site origin. Exploitation requires user interaction, since a victim must visit the page containing the injected block.
Root Cause
The root cause is insufficient input sanitization combined with missing output escaping on the blockUniqId block attribute. WordPress block attributes intended to hold simple identifiers should be normalized with sanitize_html_class or similar helpers and escaped with esc_attr on render. ShopLentor versions through 3.3.8 perform neither step, allowing HTML and script payloads to persist in post content and execute on render.
Attack Vector
An attacker with contributor-level access edits a post and inserts a ShopLentor Product Grid block. The attacker manipulates the blockUniqId attribute, either through the block editor or by submitting crafted post content via the REST API. The malicious payload is stored in the post. When any visitor, including administrators, loads the page, the script runs in their browser. Because the scope is changed (S:C in the CVSS vector), the impact reaches users beyond the attacker's own privilege boundary.
No verified public proof-of-concept code is available. Refer to the Wordfence Vulnerability Analysis and the WordPress Plugin Changeset for the patched code paths.
Detection Methods for CVE-2026-6287
Indicators of Compromise
- Post or page content containing ShopLentor Product Grid blocks where the blockUniqId attribute includes characters outside the expected alphanumeric identifier pattern.
- Unexpected <script> tags, event handlers (onerror, onload), or javascript: URIs in rendered Product Grid markup.
- Outbound browser requests from administrator sessions to unfamiliar domains shortly after viewing posts created by contributor accounts.
- Recently created or promoted contributor accounts that authored posts containing ShopLentor blocks.
Detection Strategies
- Query the wp_posts table for post_content matching wp:woolentor blocks and inspect blockUniqId values for non-identifier characters.
- Review WordPress audit logs for contributor-level post edits that add or modify Product Grid blocks.
- Scan rendered pages with a headless browser and content security policy reporting to surface unexpected script execution.
Monitoring Recommendations
- Enable WordPress activity logging to capture post creation, updates, and user role changes by non-administrator accounts.
- Monitor web server access logs for repeated /wp-json/wp/v2/posts requests from contributor accounts containing block markup.
- Alert on administrative session anomalies such as cookie reuse from new IP addresses following a post view.
How to Mitigate CVE-2026-6287
Immediate Actions Required
- Update the ShopLentor plugin to the version released in changeset 3521229 or later, which patches the affected Product Grid blocks.
- Audit all contributor, author, and editor accounts and remove any that are unrecognized or inactive.
- Review all posts and pages containing ShopLentor blocks and remove any malicious blockUniqId values prior to republishing.
- Rotate administrator session cookies and credentials if injected content was rendered by privileged users.
Patch Information
The vendor addressed the issue in the ShopLentor (woolentor-addons) repository under WordPress Plugin Changeset 3521229. The fix adds proper sanitization and output escaping for the blockUniqId attribute across the affected Product Grid blocks. Administrators should upgrade to the next released version above 3.3.8 through the WordPress plugin updater.
Workarounds
- Restrict contributor-level and higher accounts to trusted users only, and disable open user registration where not required.
- Apply a web application firewall rule that blocks block-editor submissions containing <script>, on*=, or javascript: patterns in blockUniqId.
- Deploy a strict Content Security Policy that disallows inline scripts to reduce the impact of stored XSS payloads.
- Temporarily disable the ShopLentor plugin on high-value sites until the patched version is deployed.
# Update ShopLentor via WP-CLI to the patched release
wp plugin update woolentor-addons
wp plugin get woolentor-addons --field=version
# Identify posts containing ShopLentor blocks for manual review
wp db query "SELECT ID, post_title, post_author FROM wp_posts \
WHERE post_content LIKE '%wp:woolentor%' AND post_status IN ('publish','draft');"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
