CVE-2026-6287

MediumCVSS 5.4/10Last modified Jul 24, 2026

Description

The ShopLentor - WooCommerce Builder for Elementor & Gutenberg plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'blockUniqId' block attribute in multiple Product Gride blocks in versions up to, and including, 3.3.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: May 27, 2026
Last modified: Jul 24, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-628708.8Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.CVE-2026-628717.8Out-of-bounds write in .NET allows an unauthorized attacker to execute code locally.CVE-2026-628728.8Incorrect authorization in .NET Framework allows an authorized attacker to elevate privileges over a network.CVE-2026-628739.8Improper verification of cryptographic signature in Microsoft 365 Admin Center allows an unauthorized attacker to elevate privileges over a CVE-2026-628749.8Insufficient verification of data authenticity in Azure Billing allows an unauthorized attacker to elevate privileges over a network.CVE-2026-628767.8Out-of-bounds read in Windows Win32K allows an authorized attacker to elevate privileges locally.CVE-2026-628777.8Stack-based buffer overflow in Windows Win32K allows an authorized attacker to elevate privileges locally.CVE-2026-628789.8Stack-based buffer overflow in Windows DNS allows an unauthorized attacker to execute code over a network.CVE-2026-628795.5Missing authentication for critical function in Windows SmartScreen allows an authorized attacker to perform tampering locally.CVE-2026-628807.8Out-of-bounds read in Windows NTFS allows an authorized attacker to elevate privileges locally.CVE-2026-628816.7Numeric truncation error in Windows DNS allows an authorized attacker to elevate privileges locally.CVE-2026-628824.3Insufficiently protected credentials in Microsoft Office Outlook allows an unauthorized attacker to perform spoofing over a network.