Alex Joseph
The digital landscape relies heavily on website plugins to enhance functionality, but occasionally, these tools can introduce security risks. A recent discovery, identified as CVE-2025-11823, highlights a Stored Cross-Site Scripting (XSS) vulnerability within the ShopLentor – WooCommerce Builder for Elementor & Gutenberg +21 Modules – All in One Solution plugin for WordPress. This issue could allow attackers to compromise website integrity and user experience.
This vulnerability stems from inadequate input sanitization and output escaping. Specifically, the ‘button_exist_text’ parameter within the ‘wishsuite_button’ shortcode is at fault. Attackers who have at least Contributor-level access on a WordPress site can exploit this by injecting malicious web scripts. These scripts then lie dormant on the website until a user visits an affected page, at which point the scripts execute in the user’s browser. This can lead to various issues, including unauthorized data access, session hijacking, or defacing the website.
CVE Details
Product: ShopLentor – WooCommerce Builder for Elementor & Gutenberg +21 Modules – All in One Solution (WordPress Plugin)
CVE ID: CVE-2025-11823
Published: October 25, 2025
Severity: Medium
Status: Analyzed
Affected Products
All versions of the ShopLentor – WooCommerce Builder for Elementor & Gutenberg +21 Modules – All in One Solution plugin for WordPress up to, and including, version 3.2.4 are vulnerable to this issue.
Current Status
As of October 8, 2026, this vulnerability is officially “Analyzed” within the CVE system. This means the details of the flaw have been reviewed and validated. Users are strongly advised to remain vigilant for updates and follow recommended security practices.
Severity Level
This vulnerability has been assigned a ‘Medium’ severity rating with a CVSS score of 6.4. A medium severity rating indicates that while exploitation is possible, it might require certain conditions, such as authenticated access in this case (Contributor-level or higher). However, the potential impact, including arbitrary web script execution and potential user data compromise, remains significant, making prompt action crucial for site administrators.
Possible Solutions
The most effective solution for this Stored Cross-Site Scripting vulnerability is to update your ShopLentor plugin to the latest available version as soon as a fix is released. Always ensure your WordPress core, themes, and all plugins are kept up-to-date to benefit from the latest security patches. If an immediate update is not available, consider temporarily deactivating the ShopLentor plugin or implementing Web Application Firewall (WAF) rules that can help detect and block malicious script injections. Regularly auditing user roles and permissions can also limit the attack surface by ensuring only trusted individuals have contributor or higher access.
References
https://plugins.trac.wordpress.org/browser/woolentor-addons/tags/3.2.2/includes/modules/wishlist/includes/classes/Frontend/Shortcode.php#L107
https://plugins.trac.wordpress.org/browser/woolentor-addons/tags/3.2.2/includes/modules/wishlist/includes/templates/wishsuite-button-exist.php#L1
https://www.wordfence.com/threat-intel/vulnerabilities/id/2d45afd4-9a1f-402c-86e3-8e3d6d7178d3?source=cve
