CVE-2026-92554: ShopLentor WooCommerce Plugin XSS Vulnerability

CVE-2026-92554 Overview

CVE-2026-92554 is a Reflected Cross-Site Scripting (XSS) vulnerability in the ShopLentor plugin (formerly WooLentor) for WordPress. The flaw affects all versions up to and including 3.5.1 of the All-in-One WooCommerce Growth & Store Enhancement Plugin. Unauthenticated attackers can inject arbitrary JavaScript that executes when a victim clicks a crafted link. The issue resides in the WL: Product Horizontal Filter widget, which reflects query-string parameter names into option element value attributes without escaping. This allows an attacker to break out of the attribute context and inject script payloads. The vulnerability is tracked under CWE-79.

Critical Impact
Unauthenticated attackers can execute arbitrary JavaScript in a victim's browser session, enabling session theft, credential harvesting, and administrative account takeover on affected WooCommerce stores.

Affected Products

ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin (woolentor-addons) for WordPress
All plugin versions up to and including 3.5.1
WordPress sites using the WL: Product Horizontal Filter widget

Discovery Timeline

2026-09-18 - CVE-2026-92554 published to NVD
2026-09-19 - Last updated in NVD database

Technical Details for CVE-2026-92554

Vulnerability Analysis

The vulnerability is a Reflected Cross-Site Scripting flaw in the ShopLentor plugin's product filter widget. The WL: Product Horizontal Filter component reads query-string parameter names from the current request URL and renders them directly into HTML option element value="..." attributes. Because the plugin performs neither input sanitization nor output escaping on those parameter names, an attacker can craft a URL containing a parameter name that closes the surrounding attribute quote and injects arbitrary HTML or JavaScript. Successful exploitation requires user interaction, such as clicking a malicious link, and the injected script executes in the origin of the target WordPress site.

Root Cause

The root cause is missing output escaping when the widget reflects untrusted URL parameter names into an HTML attribute context. The affected code paths are documented in the WordPress plugin trac at wl_product_horizontal_filter.php lines 1172 and 1229. Parameter names should be validated against an allow-list and passed through esc_attr() before being rendered inside value="" attributes. The absence of these controls allows attribute-context breakout via characters such as " and >.

Attack Vector

Exploitation occurs over the network with no authentication required. An attacker constructs a URL to a page that renders the vulnerable widget, appending a query-string parameter whose name contains a payload designed to break out of the value="" context. The attacker then delivers this URL through phishing emails, malicious posts, or third-party sites. When a victim visits the link, the rendered page executes the injected script in the victim's browser under the WordPress site origin. The scope-changed impact means the script can act on behalf of the visitor, including administrators, to hijack sessions or perform state-changing actions. Additional technical context is available in the Wordfence advisory.

Detection Methods for CVE-2026-92554

Indicators of Compromise

Web server access logs containing query-string parameter names with HTML metacharacters such as ", <, >, or onerror=
Requests to pages rendering the ShopLentor product filter widget with unusually long or encoded parameter names
Referrer headers originating from external domains directing users to WooCommerce catalog or filter pages with suspicious query strings
Unexpected outbound requests from administrator browsers to attacker-controlled domains following clicks on external links

Detection Strategies

Inspect HTTP request logs for URL parameter names containing script-injection patterns such as "><script, onmouseover=, or javascript:
Deploy Web Application Firewall (WAF) rules that flag reflected XSS payloads appearing in query-string parameter names, not only values
Correlate visits to catalog and filter pages with subsequent anomalous administrative actions in WordPress audit logs
Perform authenticated scans of WordPress deployments to identify installations of woolentor-addons at version 3.5.1 or earlier

Monitoring Recommendations

Enable verbose logging on WordPress and the fronting web server to capture full request URIs including parameter names
Monitor for creation of new administrator accounts, plugin installations, or theme edits following user interactions with external links
Track WooCommerce store frontend traffic for spikes in requests carrying encoded or malformed query strings
Alert on Content Security Policy (CSP) violation reports indicating inline script execution on catalog pages

How to Mitigate CVE-2026-92554

Immediate Actions Required

Update the ShopLentor plugin to a version later than 3.5.1 as soon as the vendor-released patch is available
Audit WordPress sites to inventory installations of woolentor-addons and identify vulnerable versions
Review recent administrator activity for signs of session hijacking or unauthorized configuration changes
Rotate administrator credentials and invalidate active sessions if suspicious activity is identified

Patch Information

The vendor addressed the vulnerability in the plugin repository. See the WordPress plugin changeset for the code changes that introduce proper escaping for reflected query-string parameter names. Site administrators should apply the fixed release through the WordPress plugin updater or by replacing the plugin files with the patched version.

Workarounds

Disable or remove the WL: Product Horizontal Filter widget from all pages until the plugin can be updated
Deploy a WAF rule blocking requests whose query-string parameter names contain HTML metacharacters or script keywords
Implement a restrictive Content Security Policy (CSP) that disallows inline script execution on WooCommerce frontend pages
Restrict administrator sessions by enforcing short session lifetimes and requiring re-authentication for sensitive actions

bash

# Example WAF rule (ModSecurity) blocking XSS payloads in query-string parameter names
SecRule ARGS_NAMES "@rx (?i)(<script|onerror=|onload=|javascript:|\"\s*>)" \
    "id:1092554,phase:2,deny,status:403,\
    msg:'Potential Reflected XSS in query-string parameter name (CVE-2026-92554)',\
    tag:'CWE-79'"