CVE-2026-6020: Use of Externally-Controlled Input to Select Classes or Code

The ShopLentor plugin for WordPress is vulnerable to arbitrary function execution via the woolentoropt/v1/custom-action REST API endpoint in all versions up to, and including, 3.3.7. This is due to the handleaction method passing user-supplied input directly to calluserfunc without an allowlist o...

PT-2025-11030

Name of the Vulnerable Software and Affected Versions: The ShopLentor – WooCommerce Builder for Elementor & Gutenberg +20 Modules – All in One Solution plugin for WordPress versions up to, and including, 3.1.0 Description: The issue is related to a Stored DOM-Based Cross-Site Scripting...

PT-2024-36505

Name of the Vulnerable Software and Affected Versions The ShopLentor – WooCommerce Builder for Elementor & Gutenberg +12 Modules – All in One Solution plugin for WordPress versions up to, and including, 2.9.0 Description The issue is related to Stored Cross-Site Scripting via the plugin's WL:...