The WPC Smart Messages for WooCommerce plugin contains a stored XSS flaw that originates from insufficient sanitization and escaping of the "text" attribute in the wpcsm_text_rotator shortcode. A contributor‑level or higher authenticated attacker can embed arbitrary JavaScript into this attribute, and the script will execute in a browser when any user views a page containing the shortened content.

WordPress sites that have the WPC Smart Messages for WooCommerce plugin installed and running any version up to and including 4.2.8 are impacted. The flaw requires that the user have the ability to modify content, such as a contributor role or higher, on the affected site.

The CVSS score of 6.4 indicates moderate severity. Exploitation can only occur with a valid contributor‑level or higher account, which limits the attacker pool but remains a concern in communities with many contributors. No EPSS data is available, and the vulnerability has not been listed in CISA’s KEV catalogue. Once a malicious script is stored, any site visitor who views the page will have the code executed in their browser, providing a client‑side code execution vector.