CVE-2026-85575

Name of the Vulnerable Software and Affected Versions ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution with eCommerce Templates & Woo Widgets versions prior to 4.9.6

Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Authenticated attackers with Author-level access and above can inject arbitrary web scripts through the shopengine product title header size parameter. These scripts execute whenever a user accesses the affected page.

Recommendations Update to a version newer than 4.9.5. As a temporary workaround, restrict access to the shopengine product title header size parameter for users with Author-level permissions.