Shoplentor vulnerabilities | LiveThreat CVE Feed — Verisq

Login Request a demo

SH

Product

Shoplentor

by Hasthemes · last CVE Nov 4, 2025

19

CVEs

0

On KEV

9.8

Max CVSS

0

New 30D

Vulnerabilities19 In the news0 Timeline

Severity mix

Critical 2High 1Medium 16Low 0

Severity

All severities19 Critical2 High1 Medium16 Low0

Exploitation

On CISA KEV0 Exploited in the wild0

Watch

Add Shoplentor to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2025-12493	9.8	1%	Nov 4	ShopLentor <= 3.2.5 - Unauthenticated Local PHP File Inclusion via 'load_template' Affected: before 3.2.6
CVE-2023-0232	9.8	3%	Feb 21	The ShopLentor WordPress plugin before 2.5.4 unserializes user input from cookies in order to track viewed products and user data, which could lead to PHP Object Injection Affected: before 2.5.4
CVE-2024-4566	7.1	0%	May 21	The ShopLentor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajax_dismiss function in all versions up to, and… Affected: before 2.8.9
CVE-2025-3775	6.5	0%	Apr 25	ShopLentor – WooCommerce Builder for Elementor & Gutenberg +20 Modules – All in One Solution (formerly WooLentor) <= 3.1.2 - Unauthenticated Server-Side Request Forgery via URL Parameter Affected: before 3.1.3
CVE-2024-9538	6.5	0%	Oct 11	The ShopLentor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.9.8 via the 'render' function in… Affected: before 2.9.9
CVE-2024-2868	6.4	0%	Apr 4	The ShopLentor – WooCommerce Builder for Elementor & Gutenberg +12 Modules – All in One Solution (formerly WooLentor) plugin for WordPress is vulnerable to Stored Cross-Site… Affected: before 2.8.4
CVE-2025-11823	5.4	0%	Oct 25	ShopLentor – WooCommerce Builder for Elementor & Gutenberg +21 Modules – All in One Solution <= 3.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Affected: before 3.2.5
CVE-2025-58990	5.4	0%	Sep 9	WordPress ShopLentor Plugin <= 3.2.0 - Cross Site Scripting (XSS) Vulnerability Affected: before 3.2.1
CVE-2025-1527	5.4	0%	Mar 12	ShopLentor – WooCommerce Builder for Elementor & Gutenberg +20 Modules – All in One Solution (formerly WooLentor) <= 3.1.0 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Flash Sale Countdown Module Affected: before 3.1.1
CVE-2024-5530	5.4	0%	Jun 11	The ShopLentor – WooCommerce Builder for Elementor & Gutenberg +12 Modules – All in One Solution (formerly WooLentor) plugin for WordPress is vulnerable to Stored Cross-Site… Affected: before 2.9.1
CVE-2024-34767	5.4	0%	Jun 3	Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in HasThemes ShopLentor allows Stored XSS.This issue affects ShopLentor:… Affected: before 2.8.8
CVE-2024-3345	5.4	0%	May 21	The ShopLentor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's woolentorsearch shortcode in all versions up to, and including, 2.8.8 due to… Affected: before 2.8.9
CVE-2024-3991	5.4	0%	May 2	The ShopLentor – WooCommerce Builder for Elementor & Gutenberg +12 Modules – All in One Solution (formerly WooLentor) plugin for WordPress is vulnerable to Stored Cross-Site… Affected: before 2.8.8
CVE-2024-1057	5.4	0%	Apr 20	The ShopLentor – WooCommerce Builder for Elementor & Gutenberg +10 Modules – All in One Solution (formerly WooLentor) plugin for WordPress is vulnerable to Stored Cross-Site… Affected: before 2.8.2
CVE-2024-2946	5.4	0%	Apr 9	The ShopLentor – WooCommerce Builder for Elementor & Gutenberg +12 Modules – All in One Solution (formerly WooLentor) plugin for WordPress is vulnerable to Stored Cross-Site… Affected: before 2.8.5
CVE-2024-1960	5.4	1%	Apr 9	The ShopLentor – WooCommerce Builder for Elementor & Gutenberg +12 Modules – All in One Solution (formerly WooLentor) plugin for WordPress is vulnerable to Stored Cross-Site… Affected: before 2.8.2
CVE-2023-0231	5.4	1%	Feb 21	The ShopLentor WordPress plugin before 2.5.4 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which… Affected: before 2.5.4
CVE-2023-6327	5.3	1%	May 14	The ShopLentor (formerly WooLentor) plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the purchased_new_products function in… Affected: before 2.8.8
CVE-2023-7067	4.3	0%	May 2	The ShopLentor – WooCommerce Builder for Elementor & Gutenberg +10 Modules – All in One Solution (formerly WooLentor) plugin for WordPress is vulnerable to unauthorized… Affected: before 2.8.2