ShopLentor Vulnerability – WooCommerce Builder for Elementor & Gutenberg +12 Modules – All in One Solution (formerly WooLentor) – Authenticated Stored Cross-Site Scripting via WL Universal Product Layout – CVE-2024-2868 | WordPress Plugin Vulnerability Report

Plugin Name: ShopLentor – WooCommerce Builder for Elementor & Gutenberg +12 Modules – All in One Solution (formerly WooLentor)

Key Information:

  • Software Type: Plugin
  • Software Slug: woolentor-addons
  • Software Status: Active
  • Software Author: devitemsllc
  • Software Downloads: 3,355,176
  • Active Installs: 100,000
  • Last Updated: April 4, 2024
  • Patched Versions: 2.8.4
  • Affected Versions: <= 2.8.3

Vulnerability Details:

  • Name: ShopLentor <= 2.8.3
  • Title: Authenticated (Contributor+) Stored Cross-Site Scripting via WL Universal Product Layout
  • Type: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
  • CVE: CVE-2024-2868
  • CVSS Score: 6.4
  • Publicly Published: April 3, 2024
  • Researcher: Wesley
  • Description: The ShopLentor plugin is prone to a Stored Cross-Site Scripting (XSS) vulnerability via the WL Special Day Offer Widget's slitems parameter. This vulnerability arises from the lack of proper input sanitization and output escaping, enabling authenticated attackers with at least contributor-level access to insert harmful scripts. These scripts can be executed when an unsuspecting user visits an affected page.


ShopLentor, a popular WooCommerce builder for WordPress, is currently facing a significant security issue with CVE-2024-2868. This vulnerability, found in versions up to 2.8.3, could allow attackers to perform Stored XSS attacks through the plugin's Universal Product Layout feature. The issue has been rectified in the latest patch, version 2.8.4.

Detailed Overview:

CVE-2024-2868, discovered by security researcher Wesley, exposes a critical oversight in the ShopLentor plugin's security mechanisms, particularly in how it handles inputs within its Universal Product Layout. Attackers could exploit this flaw to execute arbitrary scripts, compromising the integrity of affected WordPress sites and potentially leading to data breaches. The remediation provided in version 2.8.4 addresses this issue, emphasizing the need for stringent security practices in plugin development.

Advice for Users:

  • Immediate Action: To protect against CVE-2024-2868, users should immediately update their ShopLentor plugin to version 2.8.4.
  • Check for Signs of Vulnerability: Website administrators should keep an eye out for suspicious activities or content that might suggest an exploitation of this vulnerability.
  • Alternate Plugins: Considering alternative plugins with similar functionalities and a strong security record could be a prudent measure.
  • Stay Updated: Regular updates are crucial for maintaining the security of WordPress sites, as they often include patches for newly discovered vulnerabilities.


The swift patching of CVE-2024-2868 in the ShopLentor plugin highlights the critical importance of keeping WordPress plugins up to date. For WordPress site owners, especially those running e-commerce platforms, staying vigilant and promptly applying software updates is essential for safeguarding against potential security threats. In the evolving landscape of cyber threats, maintaining an up-to-date and secure WordPress site is paramount for protecting user data and preserving the trust of your site visitors.


Detailed Report: 

In the digital ecosystem of WordPress, plugins like ShopLentor – WooCommerce Builder for Elementor & Gutenberg enhance the functionality and aesthetic of e-commerce sites. However, the recent discovery of a critical vulnerability within ShopLentor, identified as CVE-2024-2868, underscores the ever-present need for vigilance in maintaining the security of WordPress sites. This blog post delves into the vulnerability's specifics, its potential impacts, and the measures necessary to safeguard your online presence.

About ShopLentor Plugin

ShopLentor, formerly known as WooLentor, is a versatile plugin by devitemsllc, boasting over 3 million downloads and 100,000 active installations. It's designed to extend the capabilities of WooCommerce stores through Elementor & Gutenberg, offering over 12 modules for a comprehensive e-commerce solution.

The Vulnerability: CVE-2024-2868

CVE-2024-2868 is a Stored Cross-Site Scripting (XSS) vulnerability found in versions up to 2.8.3 of ShopLentor. The flaw exists within the WL Universal Product Layout's slitems parameter, where insufficient input sanitization and output escaping allow authenticated users with at least contributor-level access to inject malicious scripts. These scripts could be executed on unsuspecting users' browsers, leading to potential data breaches and site integrity compromises. Security researcher Wesley unveiled this vulnerability, emphasizing the intricate security landscape plugins navigate.

Risks and Impacts

The primary risk of CVE-2024-2868 lies in its ability to compromise website security and user data. Malicious scripts executed via this vulnerability can lead to unauthorized access, data theft, and a tarnished site reputation among visitors and customers.

Remediation Measures

In response to this vulnerability, the developers of ShopLentor promptly released version 2.8.4, effectively patching the vulnerability. Users are urged to update their ShopLentor plugin immediately to this latest version to protect against potential exploits of CVE-2024-2868.

Previous Vulnerabilities

ShopLentor has encountered similar challenges in the past, with 6 vulnerabilities reported since April 13, 2021. Each incident reinforces the importance of regular updates and security audits.

Conclusion: The Importance of Staying Updated

The prompt resolution of CVE-2024-2868 by ShopLentor's developers is a testament to the critical nature of timely software updates in securing WordPress sites. For small business owners who manage their online platforms, balancing numerous responsibilities, the incident serves as a stark reminder of the importance of staying on top of security vulnerabilities. Ensuring your WordPress plugins are up-to-date is not just a recommendation but a necessity in today's cyber threat landscape. By prioritizing regular maintenance and updates, site owners can fortify their defenses against evolving threats, safeguarding their digital assets and maintaining the trust of their users.

Staying Secure

Staying on top of WordPress security can feel overwhelming for small business owners without dedicated IT staff. At Your WP Guy, we exist to shoulder that burden for you. Our WordPress experts can fully audit, secure, maintain and support your site - so you can focus on growing your business with peace of mind.

Don't tackle security risks alone. Let us help you assess any impact from this vulnerability, update your plugins, and implement ongoing maintenance to avoid future threats. We treat your website like it's our own - because we know how critical it is for reaching your customers.

Get in touch for a free consultation today on making WordPress security stress-free. Call 678-995-5169 or book a call here. Our knowledgeable team is ready to help you safeguard your online presence.

ShopLentor Vulnerability – WooCommerce Builder for Elementor & Gutenberg +12 Modules – All in One Solution (formerly WooLentor) – Authenticated Stored Cross-Site Scripting via WL Universal Product Layout – CVE-2024-2868 | WordPress Plugin Vulnerability Report FAQs

Leave a Comment