Back to the CVE list

CVE-2026-6020

ShopLentor <= 3.3.7 - Authenticated (Administrator+) Arbitrary Function Execution via 'callback' Parameter via REST API

CVSS score

7.2

EPSS probability

%0.8

Risk score

0.1

Published

2 mo ago

Overview Public Exploits (0)Newsroom Vulnerability Timeline

Related Security News

Articles and analysis bulletins in which the press and security publications have covered this vulnerability:

No verified news item has been matched to this CVE yet.

Similar Vulnerabilities

8.8

CVE-2026-19806Support Genix <= 1.4.52 - Authenticated (Subscriber+) Authentication Bypass to Administrator Account Takeover via 'p' Parameter Forged Guest Token

Vendordevitemsllc ProductSupport Genix – Helpdesk, AI Chatbot, Knowledge Base & Customer Support Ticketing System

Patch status unknownEPSS %01 mo ago

6.1

CVE-2026-92554ShopLentor <= 3.5.1 - Reflected Cross-Site Scripting via Query-String Parameter Name

Vendordevitemsllc ProductShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin

Patch status unknownEPSS %01 mo ago

6.4

CVE-2026-11895HT Mega Addons for Elementor <= 3.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Data Table 'display_options' Setting

Vendordevitemsllc ProductHT Mega Addons for Elementor – Elementor Widgets & Template Builder

Patch status unknownEPSS %019 d ago

Get this vulnerability through the API

Affected products, version ranges, exploitation status and patch information in a single request, with a free key.

Get a free key Documentation

curl -H "x-api-key: $DAYBREACH_API_KEY" \
  "https://api.daybreach.dev/api/v1/intel/cves/CVE-2026-6020"