ShopLento WooCommerce Builder <=3.3.8 Authenticated Stored XSS via blockUniqId (CVE-2026-6287)

漏洞概述 漏洞名称: ShopLento - WooCommerce Builder for Elementor & Gutenberg <= 3.3.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Product Grid 'blockUniqId' Block Attribute CVE ID: CVE-2026-6287 CVSS 评分: 5.4 (Medium) 发布日期: May 26, 2026 最后更新日期: May 27, 2026 研究人员: ammonia - UC SANTA BARBARA 影响范围 软件类型: Plugin 软件名称: wooqlentor-addons (view on wordpress.org) 受影响版本: <= 3.3.8 修复版本: 3.9 修复方案 修复建议: 升级到版本 3.9 或更新的已修补版本。 其他信息 漏洞描述: ShopLento - WooCommerce Builder for Elementor & Gutenberg 插件在 WordPress 中通过 'blockUniqId' 块属性在多个产品网格块中存在存储型跨站脚本漏洞。由于输入清理和输出转义不足，攻击者可以注入任意脚本，当用户访问受影响的页面时执行。 参考链接: plugins.trac.wordpress.org 近期相关漏洞 ShopLento - WooCommerce Builder for Elementor & Gutenberg <= 3.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'button_text' Shortcode Attribute - CVE ID: CVE-2026-4059 - CVSS 评分: 6.4 - 研究人员: zalm - 日期: April 13, 2026 ShopLento <= 3.3.2 - Unauthenticated Email Relay Abuse via wooqlentor_suggest_price_action AJAX Action - CVE ID: CVE-2026-7174 - CVSS 评分: 8.6 - 研究人员: Teerachai Somprasong - 日期: February 17, 2026 ShopLento <= 3.2.5 - Unauthenticated Local PHP File Inclusion via 'load_template' - CVE ID: CVE-2025-12493 - CVSS 评分: 9.8 - 研究人员: mikemyers - 日期: November 3, 2025 ShopLento - WooCommerce Builder for Elementor & Gutenberg <= 3.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode - CVE ID: CVE-2025-11823 - CVSS 评分: 6.4 - 研究人员: theviper17y - 日期: October 24, 2025 ShopLento <= 3.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting - CVE ID: CVE-2025-58990 - CVSS 评分: 6.4 - 研究人员: Denver Jackson - 日期: September 9, 2025 ShopLento - WooCommerce Builder for Elementor & Gutenberg <= 3.1.2 - Unauthenticated Server-Side Request Forgery via URL Parameter - CVE ID: CVE-2025-3775 - CVSS 评分: 6.5 - 研究人员: mikemyers - 日期: April 24, 2025 ShopLento - WooCommerce Builder for Elementor & Gutenberg <= 3.1.0 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Flash Sale Countdown Module - CVE ID: CVE-2025-1527 - CVSS 评分: 6.4 - 研究人员: Webbenaut - 日期: March 11, 2025 ShopLento <= 2.9.8 - Authenticated (Contributor+) Sensitive Information Exposure via WL FAQ Widget Elementor Template - CVE ID: CVE-2024-9538 - CVSS 评分: 4.3 - 研究人员: Ankit Patel - 日期: October 10, 2024 ShopLento - WooCommerce Builder for Elementor & Gutenberg <= 3.12 Modules - All in One Solution (formerly WooLentor) <= 2.9.7 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting - CVE ID: CVE-2024-8668 - CVSS 评分: 6.4 - 研究人员: Webbenaut - 日期: September 24, 2024 ShopLento - WooCommerce Builder for Elementor & Gutenberg <= 3.12 Modules - All in One Solution (formerly WooLentor) <= 2.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via WL Product Horizontal Filter Widget - CVE ID: CVE-2024-5530 - CVSS 评分: 6.4 - 研究人员: wesley (wcraft) - 日期: June 10, 2024 总结 该页面详细列出了 ShopLento 插件的多个安全漏洞，包括存储型跨站脚本、本地文件包含、服务器端请求伪造等。建议用户尽快升级到最新版本以修复这些漏洞。

目標達成すべての支援者に感謝 — 100%達成しました！

ShopLento WooCommerce Builder <=3.3.8 Authenticated Stored XSS via blockUniqId (CVE-2026-6287)

このソースからの他の記事

目標達成 すべての支援者に感謝 — 100%達成しました！

ShopLento WooCommerce Builder <=3.3.8 Authenticated Stored XSS via blockUniqId (CVE-2026-6287)

このソースからの他の記事

目標達成すべての支援者に感謝 — 100%達成しました！