WPC Smart Messages for WooCommerce CVE-2026-6725

Exploitation requires an authenticated WordPress user account with contributor-level capabilities or higher (Editor, Admin). The wpcsm_text_rotator shortcode must be used in page or post content; if the shortcode is never invoked or the plugin is deactivated, the vulnerability is not exploitable. The 'text' attribute parameter must be passed to the shortcode without proper escaping. Default WordPress installations with the plugin active are vulnerable if any contributor-or-above user account exists. Exploitation is limited to WordPress sites where this plugin is installed and activated; sites without the plugin are unaffected.

CVSS 6.4 (Medium) with network vector, low complexity, and low privileges required (PR:L indicates authenticated access needed) presents moderate risk. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) correctly reflects that attackers need valid WordPress credentials at contributor level or higher, limiting the initial attack surface to trusted or compromised user accounts. However, the scope change (S:C) and ability to inject arbitrary JavaScript that persists across all page views elevates practical risk for multi-author WordPress sites or those with guest content. No EPSS score or CISA KEV confirmation provided in input data. No public exploit code identified at analysis time. The realistic risk depends heavily on site trust model: isolated WordPress instances with few contributors face lower risk, while community platforms or agency-managed sites with multiple contributors face higher risk from malicious insiders or compromised credentials. The lack of user interaction requirement (UI:N) means scripts execute automatically on page load without victim action.

A contributor-level WordPress user (or an attacker who has compromised such an account) creates a page or post containing the wpcsm_text_rotator shortcode with a 'text' attribute containing JavaScript payload, such as [wpcsm_text_rotator text="<img src=x onerror='fetch("/wp-admin/user-new.php",{method:"POST",body:"..."})'>"]. The injected script is stored in the WordPress database without sanitization. When any site visitor views the affected page, the JavaScript executes in their browser context with the privileges of the logged-in user (if any), allowing credential theft, admin account creation, malware injection, or data exfiltration.