The WPC Badge Management for WooCommerce plugin stores user‑supplied text entered into the 'text' attribute of the wpcbm_best_seller shortcode without proper sanitization or escaping, enabling an attacker with Shop Manager‑level or higher privileges to inject arbitrary JavaScript that is persisted in the database. When a page containing that shortcode is viewed, the injected script executes in the browser of every user who accesses the page, allowing the attacker to run any code the user’s browser can execute.

All releases of the WPC Badge Management for WooCommerce plugin by wpclever with version 3.1.6 or earlier are vulnerable. WordPress sites that permit Shop Manager or equivalent roles to create or edit shortcode content are at risk.

The vulnerability carries a CVSS score of 5.5 and is not listed in CISA KEV; its EPSS score is not available. Exploitation requires authenticated access to modify shortcode content, limiting the threat to privileged users, but once injected the stored payload will affect every visitor to the affected page.