The digital landscape relies heavily on website plugins to enhance functionality, but occasionally, these tools can introduce security risks. A recent discovery, identified as CVE-2025-11823, highlights a Stored Cross-Site Scripting (XSS) vulnerability within the ShopLentor \u2013 WooCommerce Builder for Elementor & Gutenberg +21 Modules \u2013 All in One Solution plugin for WordPress. This issue could allow attackers to compromise website integrity and user experience.<\/p>\n
This vulnerability stems from inadequate input sanitization and output escaping. Specifically, the ‘button_exist_text’ parameter within the ‘wishsuite_button’ shortcode is at fault. Attackers who have at least Contributor-level access on a WordPress site can exploit this by injecting malicious web scripts. These scripts then lie dormant on the website until a user visits an affected page, at which point the scripts execute in the user’s browser. This can lead to various issues, including unauthorized data access, session hijacking, or defacing the website.<\/p>\n
Product:<\/strong> ShopLentor \u2013 WooCommerce Builder for Elementor & Gutenberg +21 Modules \u2013 All in One Solution (WordPress Plugin) All versions of the ShopLentor \u2013 WooCommerce Builder for Elementor & Gutenberg +21 Modules \u2013 All in One Solution plugin for WordPress up to, and including, version 3.2.4 are vulnerable to this issue.<\/p>\n As of October 8, 2026, this vulnerability is officially “Analyzed” within the CVE system. This means the details of the flaw have been reviewed and validated. Users are strongly advised to remain vigilant for updates and follow recommended security practices.<\/p>\n This vulnerability has been assigned a ‘Medium’ severity rating with a CVSS score of 6.4. A medium severity rating indicates that while exploitation is possible, it might require certain conditions, such as authenticated access in this case (Contributor-level or higher). However, the potential impact, including arbitrary web script execution and potential user data compromise, remains significant, making prompt action crucial for site administrators.<\/p>\n The most effective solution for this Stored Cross-Site Scripting vulnerability is to update your ShopLentor plugin to the latest available version as soon as a fix is released. Always ensure your WordPress core, themes, and all plugins are kept up-to-date to benefit from the latest security patches. If an immediate update is not available, consider temporarily deactivating the ShopLentor plugin or implementing Web Application Firewall (WAF) rules that can help detect and block malicious script injections. Regularly auditing user roles and permissions can also limit the attack surface by ensuring only trusted individuals have contributor or higher access.<\/p>\n https:\/\/plugins.trac.wordpress.org\/browser\/woolentor-addons\/tags\/3.2.2\/includes\/modules\/wishlist\/includes\/classes\/Frontend\/Shortcode.php#L107 The digital landscape relies heavily on website plugins to enhance functionality, but occasionally, these tools can introduce security risks. A recent discovery, identified as CVE-2025-11823, highlights a Stored<\/p>\n","protected":false},"author":17,"featured_media":2545,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[715,1299,695,726,692],"class_list":["post-4186","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-security","tag-plugin-vulnerability","tag-shoplentor","tag-web-security","tag-wordpress","tag-xss"],"yoast_head":"\n
\nCVE ID:<\/strong> CVE-2025-11823
\nPublished:<\/strong> October 25, 2025
\nSeverity:<\/strong> Medium
\nStatus:<\/strong> Analyzed<\/p>\nAffected Products<\/h2>\n
Current Status<\/h2>\n
Severity Level<\/h2>\n
Possible Solutions<\/h2>\n
References<\/h2>\n
\nhttps:\/\/plugins.trac.wordpress.org\/browser\/woolentor-addons\/tags\/3.2.2\/includes\/modules\/wishlist\/includes\/templates\/wishsuite-button-exist.php#L1
\nhttps:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/id\/2d45afd4-9a1f-402c-86e3-8e3d6d7178d3?source=cve<\/p>\n","protected":false},"excerpt":{"rendered":"