What is the CVSS score of CVE-2025-14767?

CVE-2025-14767 has a CVSS 3.1 base score of 5.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

WPC Badge Management for WooCommerce CVE-2025-14767

EUVD-2025-209823 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-05-13 Wordfence

XSS WordPress

5.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

May 13, 2026 - 08:30 vuln.today

CVE Published

May 13, 2026 - 07:44 nvd

MEDIUM 5.5

DescriptionCVE.org

The WPC Badge Management for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'text' attribute of the wpcbm_best_seller shortcode in all versions up to, and including, 3.1.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Shop Manager-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

Stored Cross-Site Scripting in WPC Badge Management for WooCommerce plugin versions up to 3.1.6 allows authenticated attackers with Shop Manager-level access to inject arbitrary JavaScript via the 'text' attribute of the wpcbm_best_seller shortcode. The injected scripts execute in the browsers of any user visiting the affected page, enabling credential theft, session hijacking, or defacement. The vulnerability stems from insufficient input sanitization and output escaping in shortcode processing.

Technical ContextAI

The wpcbm_best_seller shortcode in WPC Badge Management for WooCommerce processes user-supplied input through the 'text' attribute without proper sanitization before storage in the WordPress database (stored XSS component) or escaping before rendering in the page output (reflected component). The underlying issue is CWE-79 (Improper Neutralization of Input During Web Page Generation), a classic web application vulnerability where untrusted input is incorporated into dynamically generated HTML without appropriate encoding or filtering. The plugin is integrated into the WordPress plugin ecosystem and leverages WordPress's shortcode API (wp_add_shortcode), making it a server-side rendering context where escaping functions like esc_attr() or wp_kses_post() should have been applied.

RemediationAI

Update WPC Badge Management for WooCommerce to version 3.1.7 or later. Per the Wordfence advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/bf02edc9-2bb6-4ceb-b2a1-63f95c8becb3?source=cve) and the plugin changeset reference (https://plugins.trac.wordpress.org/changeset/3519100/), the vulnerability was fixed by implementing proper input sanitization and output escaping in the shortcode handler at includes/class-shortcode.php line 98. As a temporary workaround for sites unable to update immediately, restrict Shop Manager role assignment to only fully trusted administrators, and audit existing Shop Manager accounts to remove any unused or compromised accounts. Additionally, implement WordPress user role management plugins to log and alert on changes to Shop Manager permissions. These workarounds do not eliminate the vulnerability but reduce the attack surface by limiting who can inject malicious shortcodes.