Description
The WPC Smart Quick View for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's woosq_btn shortcode in all versions up to, and including, 4.2.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Published: 2025-08-20
Score: 6.4 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Stored Cross‑Site Scripting
Action: Apply Patch
AI Analysis

Impact

The WPC Smart Quick View for WooCommerce plugin contains insufficient input sanitization and output escaping on attributes supplied to the woosq_btn shortcode (CWE‑79). This flaw allows authenticated attackers with contributor or higher privileges to inject arbitrary JavaScript into WordPress pages. When a victim visits a page containing the malicious shortcode, the injected script is executed within the victim’s browser context.

Affected Systems

This vulnerability affects the wpclever WPC Smart Quick View for WooCommerce plugin in all releases up to and including version 4.2.1. Any WordPress installation that has the plugin installed at or below v4.2.1 is susceptible.

Risk and Exploitability

The CVSS score of 6.4 indicates moderate severity, while the EPSS score of less than 1% suggests low exploitation likelihood. The vulnerability is not listed in CISA KEV, implying it is not a widely known or publicly exploited exploit. Attackers must first authenticate as a contributor or higher role in the WordPress site and then use the woosq_btn shortcode to embed malicious scripts. The impact is limited to pages rendered after the injection; broader network compromise is not inherent to the flaw.

Generated by OpenCVE AI on April 22, 2026 at 00:54 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the WPC Smart Quick View for WooCommerce plugin to version 4.2.2 or later
  • Restrict or remove contributor‑level permissions from users and disable the use of woosq_btn shortcode for those roles
  • Implement a web‑application firewall rule that blocks non‑alphanumeric characters in the woosq_btn shortcode attributes or sanitizes supplied input before rendering

Generated by OpenCVE AI on April 22, 2026 at 00:54 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
EUVD EUVD EUVD-2025-25325 The WPC Smart Quick View for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's woosq_btn shortcode in all versions up to, and including, 4.2.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
History

Thu, 21 Aug 2025 12:45:00 +0000

Type Values Removed Values Added
First Time appeared Wordpress
Wordpress wordpress
Wpclever
Wpclever wpc Smart Quick View For Woocommerce
Vendors & Products Wordpress
Wordpress wordpress
Wpclever
Wpclever wpc Smart Quick View For Woocommerce

Wed, 20 Aug 2025 16:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 20 Aug 2025 04:45:00 +0000

Type Values Removed Values Added
Description The WPC Smart Quick View for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's woosq_btn shortcode in all versions up to, and including, 4.2.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Title WPC Smart Quick View for WooCommerce <= 4.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via woosq_btn Shortcode
Weaknesses CWE-79
References
Metrics cvssV3_1

{'score': 6.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N'}

Subscriptions

Wordpress Wordpress
Wpclever Wpc Smart Quick View For Woocommerce
cve-icon MITRE

Status: PUBLISHED

Assigner: Wordfence

Published:

Updated: 2026-04-08T16:59:28.842Z

Reserved: 2025-08-05T20:13:47.043Z

Link: CVE-2025-8618

cve-icon Vulnrichment

Updated: 2025-08-20T15:56:19.681Z

cve-icon NVD

Status : Deferred

Published: 2025-08-20T05:15:28.443

Modified: 2026-04-15T00:35:42.020

Link: CVE-2025-8618

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-22T01:00:04Z

Weaknesses