EUVD-2026-50269
GHSA-33hx-w9g7-6rmq
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
PR:L reflects required Contributor account; UI:N applied per stored XSS convention as payload fires on victim page load without further attacker action; S:C captures cross-browser scope.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Lifecycle Timeline
2DescriptionCVE.org
The WPC Badge Management for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'text' attribute of the wpcbm_best_seller shortcode in all versions up to, and including, 3.1.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
AnalysisAI
Stored Cross-Site Scripting in the WPC Badge Management for WooCommerce WordPress plugin (all versions through 3.1.6) allows authenticated attackers with Contributor-level access to inject persistent JavaScript via the 'text' attribute of the wpcbm_best_seller shortcode. The injected payload executes silently in the browser of any visitor who loads an affected page, with scope change indicated by the CVSS S:C metric. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated WordPress session with at minimum Contributor role - this is the binding prerequisite. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 6.4 base score reflects a meaningful but bounded threat: AV:N and AC:L indicate low-friction network exploitation, while PR:L gates it behind a Contributor account - a realistic but non-trivial prerequisite on multi-author or open-registration WordPress sites. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A threat actor who has registered or compromised a Contributor account on a WooCommerce WordPress site creates or edits a post, embedding a wpcbm_best_seller shortcode with a malicious JavaScript payload in the 'text' attribute. The script is stored server-side and silently executes in the browser of every visitor - including administrators - who loads the affected page, enabling cookie exfiltration or session hijacking without any further attacker interaction. … |
| Remediation | A patch commit has been applied to the plugin trunk (changeset referenced at https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3519100%40wpc-badge-management%2Ftrunk&old=3483376%40wpc-badge-management%2Ftrunk), but an exact fixed release version number is not confirmed by the available data - verify the installed version against the wordpress.org changelog and update to any release beyond 3.1.6. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today