A stored cross‑site scripting vulnerability exists in the shortcode_btn shortcode of the WPC Smart Compare for WooCommerce plugin. Insufficient input sanitization and output escaping allow an attacker with authenticated contributor‑level access to inject arbitrary JavaScript that is stored and served on any page containing the shortcode. This can lead to defacement, credential theft, session hijacking, or other malicious actions performed in the context of users who visit the affected pages.

All WordPress sites that have the wpclever WPC Smart Compare for WooCommerce plugin installed with a version up to and including 6.4.6 are affected. The plugin provides a "shortcode_btn" feature that is used by site administrators and contributors to add comparison buttons. Any site using these versions is therefore vulnerable.

The CVSS score of 6.4 indicates a medium severity level. The EPSS score of less than 1% suggests that the likelihood of real‑world exploitation is low at present. The vulnerability is not listed in the CISA KEV catalog. The attack vector requires an authenticated user with contributor or higher privileges to place or modify content containing the vulnerable shortcode, after which the malicious payload is stored in the database and served when any user views the affected page.