The vulnerability exists in the ShopLentor plugin for WordPress and is triggered by the 'blockUniqId' attribute within multiple Product Grid blocks. Because the plugin fails to sanitize or escape the attribute value, an attacker can insert JavaScript code that will be served to any visitor who views the affected page. This amounts to a stored cross‑site scripting flaw that can be leveraged by authenticated contributors or higher roles.

Affected product is the ShopLentor – All‑in‑One WooCommerce Growth & Store Enhancement Plugin developed by devitemsllc. Versions 3.3.8 and earlier are impacted; any site running those releases should check the installed version and note that the issue is resolved in later releases.

The CVSS score of 5.4 indicates moderate severity. No EPSS data is available and the vulnerability is not listed in CISA KEV, suggesting limited public exploitation data. Because the flaw requires valid contributor or higher credentials, the attack surface is limited to users with edit permissions, but once injected the malicious script runs in the browser context of every visitor to the maliciously modified page.