The defect allows improper neutralization of user‑supplied input during web page generation in the DevItems ShopLentor woolentor‑addons plugin. Attackers can inject malicious JavaScript that is stored and later rendered for other site visitors. This stored XSS can lead to session hijacking, credential theft, or defacement, compromising user confidentiality and application integrity. The weakness is a classic input validation failure (CWE‑79).

The vulnerability affects the DevItems ShopLentor woolentor‑addons WordPress plugin vendor "DevItems:ShopLentor" in all releases from the initial version up to and including 3.2.0. No later versions have been reported affected.

The CVSS score of 6.5 indicates moderate severity, while the EPSS score of less than 1 % suggests the likelihood of active exploitation is low and the vulnerability is not currently in the CISA KEV catalog. Attackers would typically need the ability to input data that is stored by the plugin, such as product descriptions or metadata, and then persuade a page‑viewing user to load that content. Given the persistence of stored XSS and the broad user base of WordPress sites, the potential for impact remains significant if an attacker succeeds.