WordPress ShopLentor plugin <= 3.1.0 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Flash Sale Countdown Module vulnerability

🗓️ 11 Mar 2025 23:39:52Reported by WebbernautType

Authenticated users can trigger stored DOM-based Cross Site Scripting in ShopLentor Flash Sale Countdown up to version 3.1.0.

Reporter	Title	Published	Views	Family All 9
Circl	CVE-2025-1527	12 Mar 202514:40	–	circl
CNNVD	WordPress plugin ShopLentor – WooCommerce Builder for Elementor & Gutenberg +20 Modules – All in One Solution 跨站脚本漏洞	12 Mar 202500:00	–	cnnvd
CVE	CVE-2025-1527	12 Mar 202511:13	–	cve
Cvelist	CVE-2025-1527 ShopLentor – WooCommerce Builder for Elementor & Gutenberg +20 Modules – All in One Solution (formerly WooLentor) <= 3.1.0 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Flash Sale Countdown Module	12 Mar 202511:13	–	cvelist
EUVD	EUVD-2025-7405	3 Oct 202520:07	–	euvd
NVD	CVE-2025-1527	12 Mar 202512:15	–	nvd
RedhatCVE	CVE-2025-1527	14 Mar 202520:58	–	redhatcve
Vulnrichment	CVE-2025-1527 ShopLentor – WooCommerce Builder for Elementor & Gutenberg +20 Modules – All in One Solution (formerly WooLentor) <= 3.1.0 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Flash Sale Countdown Module	12 Mar 202511:13	–	vulnrichment
Wordfence Blog	Wordfence Intelligence Weekly WordPress Vulnerability Report (March 10, 2025 to March 16, 2025)	20 Mar 202515:07	–	wordfence

Vulners

Node

Source	Link
wordfence	www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/woolentor-addons/shoplentor-woocommerce-builder-for-elementor-gutenberg-20-modules-all-in-one-solution-formerly-woolentor-310-authenticated-contributor-stored-dom-based-cross-site-scripting-via-flash-sale-countdown-module

11 Mar 2025 23:39Current

7.5High risk

Vulners AI Score7.5

CVSS 3.15.4 - 6.4

EPSS0.00095

SSVC