The ShopLentor plugin for WordPress is vulnerable to a stored Cross‑Site Scripting flaw, triggered by the ‘button_exist_text’ parameter in the ‘wishsuite_button’ shortcode. The input is not sanitized or escaped, enabling an authenticated attacker with Contributor or higher access to embed arbitrary JavaScript that will run whenever any user views the affected page. This flaw allows the attacker to execute code with the victim’s user context, leading to session hijacking, data theft, or defacement.

All WordPress sites running the "ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin" advertising plugin up to and including version 3.2.4 are affected. The vendor is DevItemsLLC. The issue exists specifically in the wishlist module that renders the wishsuite button via the problematic shortcode.

The CVSS score of 6.4 indicates moderate severity, while the EPSS score of < 1% suggests a low probability of exploitation in the wild. The flaw is not listed in the CISA KEV catalog, implying that it has not yet been widely leveraged by known threat actors. Exploitation requires valid Contributor‑level credentials, so any site using such roles is at risk. Once authenticated, an attacker can inject arbitrary scripts that will execute for all users who view the payload page, potentially compromising user accounts or site integrity.