CVE-2023-0232: Hasthemes Shoplentor

Critical severity, CVSS 9.8. EPSS: 3.3% chance of exploitation in the next 30 days.

The ShopLentor WordPress plugin before 2.5.4 unserializes user input from cookies in order to track viewed products and user data, which could lead to PHP Object Injection.

Affected products

• Hasthemes Shoplentor: before 2.5.4 (fixed in 2.5.4)

Published 2023-02-21. Last modified 2026-06-17.