What is the CVSS score of CVE-2026-6725?

CVE-2026-6725 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

WPC Smart Messages for WooCommerce CVE-2026-6725

EUVD-2026-25986 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-04-28 Wordfence

WordPress XSS Wordpress Plugin Wpc Smart Messages For Woocommerce Wpclever

6.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 28, 2026 - 06:01 vuln.today

EUVD ID Assigned

Apr 28, 2026 - 05:30 euvd

EUVD-2026-25986

Analysis Generated

Apr 28, 2026 - 05:30 vuln.today

CVE Published

Apr 28, 2026 - 04:28 nvd

MEDIUM 6.4

DescriptionCVE.org

The WPC Smart Messages for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'text' attribute of the wpcsm_text_rotator shortcode in all versions up to, and including, 4.2.8. This is due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

Stored cross-site scripting in WPC Smart Messages for WooCommerce plugin through version 4.2.8 allows authenticated attackers with contributor-level access to inject arbitrary JavaScript via the 'text' attribute of the wpcsm_text_rotator shortcode, resulting in execution whenever users view affected pages. The vulnerability stems from insufficient input sanitization and output escaping. No active exploitation confirmed; patch available in version 4.2.9.

Technical ContextAI

The vulnerability exists in the wpcsm_text_rotator shortcode handler within the WPC Smart Messages for WooCommerce plugin (CPE: cpe:2.3:a:wpclever:wpc_smart_messages_for_woocommerce:*:*:*:*:*:*:*:*), specifically in the class-shortcode.php file around line 458. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), where user-supplied shortcode attributes are processed and stored in the WordPress database without proper sanitization, then rendered on the front-end without adequate HTML entity encoding or escaping. This is a classic stored XSS pattern in WordPress plugins where shortcode parameters intended for legitimate content are not treated as potentially malicious input.

RemediationAI

Update WPC Smart Messages for WooCommerce to version 4.2.9 or later immediately via the WordPress admin plugin dashboard or direct download from https://wordpress.org/plugins/wpc-smart-messages. Version 4.2.9 implements proper input sanitization and output escaping for the wpcsm_text_rotator shortcode attributes (confirmed by source code changes in plugins.trac.wordpress.org/browser/wpc-smart-messages/tags/4.2.9). Until patching is possible, temporarily disable the wpcsm_text_rotator shortcode by removing or deactivating the plugin, or restrict shortcode creation to administrators only via user role controls in WordPress. As a post-remediation step, audit existing pages and posts for any injected shortcodes with suspicious 'text' attribute values and remove or sanitize them.