Executive brief
WPC Badge Management for WooCommerce is a WordPress plugin used to display promotional badges (like 'Sale' or 'Best Seller') on online stores. A security flaw allows users with contributor-level access or higher to inject malicious scripts into these badges. When other users or customers view the affected store pages, the script executes, potentially leading to unauthorized actions or data theft.
Technical details
The WPC Badge Management for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in versions up to and including 3.1.6. The vulnerability exists within the 'text' attribute of the `wpcbm_best_seller` shortcode due to insufficient input sanitization and output escaping. An authenticated attacker with Contributor-level permissions or higher can inject arbitrary web scripts into a page. These scripts will execute in the browser of any user who visits the compromised page. The issue was addressed in version 3.1.7.
Affected products
- WPClever WPC Badge Management for WooCommerce 0 - 3.1.6
Timeline
- 2026-07-29: disclosed
- 2026-07-29: advisory
- 2026-07-29: patched: Fixed in version 3.1.7
References
- https://plugins.trac.wordpress.org/browser/wpc-badge-management/tags/3.1.5/includes/class-shortcode.php
- https://plugins.trac.wordpress.org/browser/wpc-badge-management/trunk/includes/class-shortcode.php
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3519100%40wpc-badge-management%2Ftrunk&old=3483376%40wpc-badge-management%2Ftrunk&sfp_email=&sfph_mail=
- https://wordpress.org/plugins/wpc-badge-management
- https://www.wordfence.com/threat-intel/vulnerabilities/id/588e12c4-7d68-40ac-82bc-aacc5d389dee?source=cve