CVE-2024-9538 ShopLentor <= 2.9.8 - Authenticated (Contributor+) Sensitive Information Exposure via WL: FAQ Widget Elementor Template

What is CVE-2024-9538?

CVE-2024-9538 is a medium-severity vulnerability in devitemsllc ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin, published on 11 Oct 2024. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

The ShopLentor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.9.8 via the 'render' function in includes/addons/wl_faq.php. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive private, pending, and draft Elementor template data.

Weakness: CWE-200

Which versions are affected by CVE-2024-9538?

It affects 1 product.

Products include Hasthemes Shoplentor.

How do I fix CVE-2024-9538?

No fix has been published for CVE-2024-9538 yet. Limit exposure of the affected software until one is available.

Is CVE-2024-9538 being exploited?

There is no known exploitation of CVE-2024-9538 in the wild and no public exploit code.

Other vulnerabilities in devitemsllc ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin

• CVE-2025-12493 ShopLentor <= 3.2.5 - Unauthenticated Local PHP File Inclusion via 'load_template' Critical 9.8
• CVE-2023-0232 ShopLentor < 2.5.4 - PHP Object Injection Critical 9.8
• CVE-2024-4566 ShopLentor <= 2.8.8 - Missing Authorization to WordPress Option Modification High 7.1
• CVE-2025-58990 WordPress ShopLentor Plugin <= 3.2.0 - Cross Site Scripting (XSS) Vulnerability Medium 6.5
• CVE-2025-3775 Server-side request forgery in ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin Medium 6.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-w7hg-wgqh-73cr.