WordPress plugin · woolentor-addons
Is ShopLentor safe?
Safe on 3.5.5 or newer.
The current version, 3.5.5, is past every affected range on record (29 of 29 records list one). Keep it updated and you’re clear of them.
- Flaws on record
- 29
- High or critical
- 5
- Exploited
- none
- Current version
- 3.5.5
- Last updated
- Oct 19, 2026
- Active installs
- 80,000+
Every recorded flaw
- Sep 18, 2026ShopLentor – All-in-One WooCommerce Growth & Store Enhancement: Reflected Cross-Site ScriptingCVE-2026-92554 · affects up to 3.5.1 · reported by WordfenceMedium 6.1
- Aug 5, 2026ShopLentor: Arbitrary function executionCVE-2026-6020 · affects up to 3.3.7 · reported by WordfenceHigh 7.2
- Jul 28, 2026ShopLentor – All-in-One WooCommerce Growth & Store Enhancement: Time-based SQL InjectionCVE-2026-16811 · affects up to 3.4.5 · reported by WordfenceMedium 4.9
- Jul 28, 2026ShopLentor – All-in-One WooCommerce Growth & Store Enhancement: Insecure Direct Object ReferenceCVE-2026-16797 · affects up to 3.4.5 · reported by WordfenceMedium 4.3
- May 27, 2026ShopLentor - WooCommerce Builder for Elementor & Gutenberg: Stored Cross-Site ScriptingCVE-2026-6287 · affects up to 3.3.8 · reported by WordfenceMedium 5.4
- Apr 14, 2026ShopLentor: Stored Cross-Site ScriptingCVE-2026-4059 · affects up to 3.3.5 · reported by WordfenceMedium 6.4
- Feb 18, 2026ShopLentor – WooCommerce Builder for Elementor & Gutenberg +21 Modules – All in One Solution: Email Relay AbuseCVE-2026-1714 · affects up to 3.3.2 · reported by WordfenceHigh 8.6
- Nov 4, 2025ShopLentor – WooCommerce Builder for Elementor & Gutenberg +21 Modules – All in One Solution (formerly WooLentor): Local File InclusionCVE-2025-12493 · affects up to 3.2.5 · reported by WordfenceCritical 9.8
- Oct 25, 2025ShopLentor – WooCommerce Builder for Elementor & Gutenberg +21 Modules – All in One Solution: Stored Cross-Site ScriptingCVE-2025-11823 · affects up to 3.2.4 · reported by WordfenceMedium 6.4
- Sep 9, 2025ShopLentor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58990 · affects up to 3.2.0 · reported by PatchstackMedium 6.5
- Apr 25, 2025ShopLentor – WooCommerce Builder for Elementor & Gutenberg +20 Modules – All in One Solution (formerly WooLentor): Server-Side Request ForgeryCVE-2025-3775 · affects up to 3.1.2 · reported by WordfenceMedium 6.5
- Mar 12, 2025ShopLentor – WooCommerce Builder for Elementor & Gutenberg +20 Modules – All in One Solution (formerly WooLentor): A Stored DOM-Based Cross-Site ScriptingCVE-2025-1527 · affects up to 3.1.0 · reported by WordfenceMedium 6.4
- Oct 11, 2024ShopLentor: Sensitive Information ExposureCVE-2024-9538 · affects up to 2.9.8 · reported by WordfenceMedium 4.3
- Sep 25, 2024ShopLentor – WooCommerce Builder for Elementor & Gutenberg +12 Modules – All in One Solution (formerly WooLentor): Stored Cross-Site ScriptingCVE-2024-8668 · affects up to 2.9.7 · reported by WordfenceMedium 6.4
- Jun 11, 2024ShopLentor – WooCommerce Builder for Elementor & Gutenberg +12 Modules – All in One Solution (formerly WooLentor): Stored Cross-Site ScriptingCVE-2024-5530 · affects up to 2.9.0 · reported by WordfenceMedium 6.4
- Jun 3, 2024ShopLentor: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-34767 · affects up to 2.8.7 · reported by PatchstackMedium 6.5
- May 21, 2024ShopLentor: Unauthorized modification of dataCVE-2024-4566 · affects up to 2.8.8 · reported by WordfenceHigh 7.1
- May 21, 2024ShopLentor: Stored Cross-Site ScriptingCVE-2024-3345 · affects up to 2.8.8 · reported by WordfenceMedium 6.4
- May 14, 2024ShopLentor (formerly WooLentor): Unauthorized access of dataCVE-2023-6327 · affects up to 2.8.7 · reported by WordfenceMedium 5.3
- May 2, 2024ShopLentor – WooCommerce Builder for Elementor & Gutenberg +12 Modules – All in One Solution (formerly WooLentor): Stored Cross-Site ScriptingCVE-2024-3991 · affects up to 2.8.7 · reported by WordfenceMedium 6.4
- May 2, 2024ShopLentor – WooCommerce Builder for Elementor & Gutenberg +10 Modules – All in One Solution (formerly WooLentor): Unauthorized modification of dataCVE-2023-7067 · affects up to 2.8.1 · reported by WordfenceMedium 4.3
- Apr 19, 2024ShopLentor – WooCommerce Builder for Elementor & Gutenberg +10 Modules – All in One Solution (formerly WooLentor): Stored Cross-Site ScriptingCVE-2024-1057 · affects up to 2.8.1 · reported by WordfenceMedium 6.4
- Apr 9, 2024ShopLentor – WooCommerce Builder for Elementor & Gutenberg +12 Modules – All in One Solution (formerly WooLentor): Stored Cross-Site ScriptingCVE-2024-2946 · affects up to 2.8.4 · reported by WordfenceMedium 6.4
- Apr 9, 2024ShopLentor – WooCommerce Builder for Elementor & Gutenberg +12 Modules – All in One Solution (formerly WooLentor): Stored Cross-Site ScriptingCVE-2024-1960 · affects up to 2.8.1 · reported by WordfenceMedium 6.4
- Apr 3, 2024ShopLentor – WooCommerce Builder for Elementor & Gutenberg +12 Modules – All in One Solution (formerly WooLentor): Stored Cross-Site ScriptingCVE-2024-2868 · affects up to 2.8.3 · reported by WordfenceMedium 6.4
- Jul 17, 2023Cross-Site Request Forgery (CSRF) vulnerability in HasThemes ShopLentor plugin <= 2.6.2 versions.CVE-2022-47172 · affects up to 2.6.2 · reported by PatchstackMedium 4.3
- Mar 1, 2023Cross-Site Request Forgery (CSRF) vulnerability in HasThemes ShopLentor plugin <= 2.5.1 leading to plugin settings change.CVE-2022-46798 · fixed in 2.5.2 · reported by PatchstackMedium 5.4
- Feb 21, 2023ShopLentor: Unserializes user input from cookies in order to track viewed products and user dataCVE-2023-0232 · fixed in 2.5.4 · reported by WPScan3.3% oddsCritical 9.8
- Feb 21, 2023ShopLentor: Does not validate and escape some of its block options before outputting them back in a page/post where the block is embedCVE-2023-0231 · fixed in 2.5.4 · reported by WPScanMedium 5.4
Records come from the National Vulnerability Database, published by the researchers who found each flaw (Wordfence, Patchstack, WPScan and others); exploited status from CISA; exploit odds from FIRST’s EPSS; current version, installs and closures from wordpress.org, checked daily. Want every plugin on your site checked at once? Run the free website check.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Get in touch
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
01The person who'll do the work writes back
02A short call, then a written plan with the price
03Nothing starts until you say yes
04Hacked or down right now? Call, and we pick up the same day
Not ready to talk yet? Run the free website check and see what Google sees.