CVE-2026-92554 devitemsllc CVE debrief

Who should care

Defenders responsible for WordPress installations with the ShopLentor plugin version 3.5.1 or earlier should assess exposure and prioritize verification and remediation efforts. This includes reviewing the current version of the ShopLentor plugin, identifying all instances of the plugin in use, and determining the potential impact of a successful exploit on the organization.

Why it matters

CVE-2026-92554 allows unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Defenders should prioritize verifying the presence of this vulnerability in their WordPress installations and assess exposure of the ShopLentor plugin version 3.5.1 or earlier.

• Defenders must verify the presence of this vulnerability in their WordPress installations
• Exposure could allow unauthenticated attackers to inject arbitrary web scripts
• Successful exploitation requires tricking a user into performing an action such as clicking on a link
• Remediation priority follows from verifying affected versions and applying patches or updates

Technical summary

The ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via Query-String Parameter Name in all versions up to, and including, 3.5.1 due to insufficient input sanitization and output escaping. The vulnerability is triggered via the WL: Product Horizontal Filter widget, which reflects attacker-supplied query-string parameter names from the current URL into option element value attributes without escaping, allowing payload breakout from the value= attribute context. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an

Defensive priority

Defenders should prioritize verifying the presence of this vulnerability in their WordPress installations and assess exposure of the ShopLentor plugin version 3.5.1 or earlier.

Recommended defensive actions

• Verify the presence of ShopLentor plugin version 3.5.1 or earlier in WordPress installations
• Assess exposure of the ShopLentor plugin to Reflected Cross-Site Scripting via Query-String Parameter Name
• Apply patches or updates to the ShopLentor plugin as available
• Monitor for suspicious activity related to the WL: Product Horizontal Filter widget
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The vulnerability is triggered via the WL: Product Horizontal Filter widget, which reflects attacker-supplied query-string parameter names from the current URL into option element value attributes without escaping.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.