Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
The ShopLentor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the woolentor_quickview_button shortcode's button_text attribute in all versions up to, and including, 3.3.5. This is due to insufficient input sanitization and missing output escaping on user-supplied shortcode attributes. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-04-14 | 2 | Disclosure2 |
| 2026-04-15 | 1 | General1 |
⚡ New CVE Alert: CVE-2026-4059 📊 Severity: 6.4 🚨 Risk Level: Medium 🧩 Affects: Wordpress Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-4059 #CVE-2026-4059 #CVE #Medium #Wordpress #CyberSecurity #InfoSec https://t.co/pl2noee7cS
Post summary
The tweet announces CVE‑2026‑4059 affecting WordPress, providing severity and a reference link but lacking details on exploitation, PoC, patches, or technical specifics.
CVE-2026-4059 The ShopLentor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the woolentor_quickview_button shortcode's button_text attribute in all versions up… https://www.cve.org/CVERecord?id=CVE-2026-4059
Post summary
The post announces a stored XSS vulnerability in ShopLentor WordPress plugin without mentioning exploits, patches, or active attacks.
CVE-2026-4059 Stored Cross-Site Scripting in ShopLentor Plugin for WordPress Up to 3.3.5 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-4059
Post summary
CVE-2026-4059 describes a stored cross‑site scripting flaw in the ShopLentor WordPress plugin (versions up to 3.3.5); no PoC, exploit code, or active exploitation details are provided, and no patch or mitigation is mentioned.