Wpc Badge Management For Woocommerce
Monthly
Stored Cross-Site Scripting in the WPC Badge Management for WooCommerce WordPress plugin (all versions through 3.1.6) allows authenticated attackers with Contributor-level access to inject persistent JavaScript via the 'text' attribute of the wpcbm_best_seller shortcode. The injected payload executes silently in the browser of any visitor who loads an affected page, with scope change indicated by the CVSS S:C metric. No public exploit or CISA KEV listing is identified at time of analysis.
Stored Cross-Site Scripting in WPC Badge Management for WooCommerce plugin versions up to 3.1.6 allows authenticated attackers with Shop Manager-level access to inject arbitrary JavaScript via the 'text' attribute of the wpcbm_best_seller shortcode. The injected scripts execute in the browsers of any user visiting the affected page, enabling credential theft, session hijacking, or defacement. The vulnerability stems from insufficient input sanitization and output escaping in shortcode processing.
Missing Authorization vulnerability in WPClever WPC Badge Management for WooCommerce.4.0. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Stored Cross-Site Scripting in the WPC Badge Management for WooCommerce WordPress plugin (all versions through 3.1.6) allows authenticated attackers with Contributor-level access to inject persistent JavaScript via the 'text' attribute of the wpcbm_best_seller shortcode. The injected payload executes silently in the browser of any visitor who loads an affected page, with scope change indicated by the CVSS S:C metric. No public exploit or CISA KEV listing is identified at time of analysis.
Stored Cross-Site Scripting in WPC Badge Management for WooCommerce plugin versions up to 3.1.6 allows authenticated attackers with Shop Manager-level access to inject arbitrary JavaScript via the 'text' attribute of the wpcbm_best_seller shortcode. The injected scripts execute in the browsers of any user visiting the affected page, enabling credential theft, session hijacking, or defacement. The vulnerability stems from insufficient input sanitization and output escaping in shortcode processing.
Missing Authorization vulnerability in WPClever WPC Badge Management for WooCommerce.4.0. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.