Description

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mamunur Rashid ShopBuilder – Elementor WooCommerce Builder Addons shopbuilder allows Reflected XSS.This issue affects ShopBuilder – Elementor WooCommerce Builder Addons: from n/a through 3.4.1.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-10-09T10:16:42.370Z",
  "pubdate": "2026-10-09T10:16:42.370Z",
  "executiveSummary": "The ShopBuilder – Elementor WooCommerce Builder Addons plugin is susceptible to a Reflected Cross-Site Scripting (XSS) vulnerability. This security flaw stems from the improper neutralization of user-supplied input during web page generation, allowing an attacker to inject and execute arbitrary malicious JavaScript in the context of an end-user's browser session.\nThe vulnerability affects versions n/a through 3.4.1 of the ShopBuilder plugin. Successful exploitation enables an unauthorized actor to bypass browser-based security policies, potentially leading to unauthorized actions performed on behalf of the victim, theft of session cookies, or redirection to malicious websites. The impact is primarily client-side; however, in environments with administrative users, this may lead to full account compromise. Exploitation requires no specific authentication, relying instead on enticing a victim to interact with a crafted URL. This vulnerability presents a significant risk to site integrity and user data privacy within the WooCommerce ecosystem.",
  "technicalDetails": "The vulnerability is classified as Reflected Cross-Site Scripting (XSS), mapped to CWE-79 (Improper Neutralization of Input During Web Page Generation). The root cause is the failure of the ShopBuilder plugin to properly validate or sanitize request parameters before reflecting them back into the HTML response document served to the client browser.\nIn a typical attack flow, an attacker identifies a vulnerable input vector within the ShopBuilder plugin—often via URL query parameters. The attacker constructs a malicious URL containing a JavaScript payload designed to execute within the victim's browser session. When an authenticated or unauthenticated user clicks the link, the server processes the input and includes the unencoded, malicious script directly into the page source.\nThe browser, interpreting the server's response as trusted content, executes the script in the context of the vulnerable domain. Because the script runs within the site's origin, it can access Document Object Model (DOM) elements, retrieve session tokens stored in local storage or cookies, and make asynchronous requests to internal API endpoints. This allows for post-exploitation activities such as exfiltrating sensitive session data, performing unauthorized modifications to site configurations, or capturing sensitive user information entered into forms.\nThe vulnerability persists across all versions of the ShopBuilder – Elementor WooCommerce Builder Addons from the initial release through 3.4.1. Exploitation is facilitated by the lack of context-aware output encoding. There are no specialized privilege requirements for an attacker to initiate this reflected payload delivery, as the execution occurs entirely on the client-side within the victim's browser. The threat surface is broad, as any user or administrator who interacts with the malicious link while logged into the affected WordPress instance may be susceptible to account takeover or information disclosure. The primary technical requirement for the attacker is the ability to distribute the malicious URL to potential targets, relying on the victim's trust in the legitimate domain name."
}