WPC Badge Management EUVD-2026-50269

Exploitation requires an authenticated WordPress session with at minimum Contributor role - this is the binding prerequisite. The attack is specifically limited to the 'text' attribute of the wpcbm_best_seller shortcode; other plugin shortcodes or attributes are not confirmed vulnerable from available data. The WPC Badge Management plugin must be installed and active on the target site. Limiting factors: external attackers without an account cannot exploit this directly; sites that restrict contributor registration or audit shortcode usage in posts are significantly less exposed. Once stored, the payload executes passively for any user who loads the injected page - no further attacker interaction is required post-injection, and victim interaction is limited to normal page browsing.

The CVSS 6.4 base score reflects a meaningful but bounded threat: AV:N and AC:L indicate low-friction network exploitation, while PR:L gates it behind a Contributor account - a realistic but non-trivial prerequisite on multi-author or open-registration WordPress sites. The S:C (Scope Changed) flag is the most significant risk amplifier, as successful injection crosses the trust boundary into visiting users' browsers, enabling session theft, credential harvesting, or malicious redirects against an unbounded audience. No EPSS data was provided, no KEV listing exists, and no public POC has been identified, suggesting this has not yet attracted broad exploitation tooling. Real-world priority is therefore moderate: sites with multiple untrusted contributors or open contributor registration should treat this as urgent; single-author or tightly controlled sites face lower exposure. The absence of EPSS data is a gap - risk cannot be quantified probabilistically from available inputs.

A threat actor who has registered or compromised a Contributor account on a WooCommerce WordPress site creates or edits a post, embedding a wpcbm_best_seller shortcode with a malicious JavaScript payload in the 'text' attribute. The script is stored server-side and silently executes in the browser of every visitor - including administrators - who loads the affected page, enabling cookie exfiltration or session hijacking without any further attacker interaction. No public proof-of-concept code is identified at time of analysis, but the attack technique is well-understood and the barrier to exploitation is low once contributor access is obtained.