CVE-2026-4059

OVERVIEW CVE-2026-4059 is a Stored Cross-Site Scripting (XSS) vulnerability in the ShopLentor plugin for WordPress affecting all versions up to and including 3.3.5. The vulnerability exists in the woolentor_quickview_button shortcode's button_text attribute, where insufficient input sanitization and missing output escaping allow injection of malicious scripts into web pages. SEVERITY The vulnerability carries a CVSS score of 6.4 (Medium) with a network-based attack vector requiring low complexity. Exploitation requires Contributor-level or higher WordPress user privileges. The attack has cross-site scope, potentially affecting website visitors through stored malicious content. Impact is limited to low confidentiality and integrity violations with no availability impact. The FAUCET Risk Score of 44.0 indicates moderate risk requiring attention. EXPLOITATION STATUS There is no evidence of active exploitation in the wild. The vulnerability does not appear on the CISA Known Exploited Vulnerabilities (KEV) catalog and is not currently listed on the Hot List. The EPSS score of 0.0004 reflects minimal probability of exploitation, placing it well below the average CVE baseline. Community attention appears limited at this time. Organizations should prioritize patching to version 3.3.6 or later as a precautionary measure.