CVE-2024-9538: fallo de gravedad media en devitemsllc ShopLentor – All-in-One…
ShopLentor <= 2.9.8 - Authenticated (Contributor+) Sensitive Information Exposure via WL: FAQ Widget Elementor Template
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 4.3epss 0.4%
The ShopLentor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.9.8 via the 'render' function in includes/addons/wl_faq.php. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive private, pending, and draft Elementor template data.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Productos afectados
devitemsllc · ShopLentor – All-in-One WooCommerce Growth & Store Enhancement PluginCVEs relacionadas — devitemsllc ShopLentor – All-in-One…
En el mismo producto, de las más peligrosas a las menos.
CVE-2025-12493CRITICALShopLentor <= 3.2.5 - Unauthenticated Local PHP File Inclusion via 'load_template'EPSS 0.8%CVE-2026-6020HIGHShopLentor <= 3.3.7 - Authenticated (Administrator+) Arbitrary Function Execution via 'callback' Parameter via REST APIEPSS 0.8%CVE-2026-1714HIGHShopLentor <= 3.3.2 - Unauthenticated Email Relay Abuse via 'woolentor_suggest_price_action' AJAX ActionEPSS 0.7%CVE-2023-6327MEDIUMShopLentor (formerly WooLentor) <= 2.8.7 - Missing Authorization via purchased_new_productsEPSS 0.7%CVE-2024-1960MEDIUMShopLentor <= 2.8.1 - Authenticated(Contributor+) Stored Cross-Site Scripting via Banner LinkEPSS 0.5%CVE-2024-2868MEDIUMShopLentor – WooCommerce Builder for Elementor & Gutenberg +12 Modules – All in One Solution (formerly WooLentor) <= 2.8.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via WL Universal Product LayoutEPSS 0.5%