CVE-2026-92554

Name of the Vulnerable Software and Affected Versions ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin versions prior to 3.5.2

Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Reflected Cross-Site Scripting. This occurs via the WL: Product Horizontal Filter widget, which reflects attacker-supplied query-string parameter names from the URL into option element value attributes. This allows a payload to break out of the value attribute context and execute arbitrary web scripts if a user is tricked into clicking a malicious link.

Recommendations Update to version 3.5.2 or later.