Untrusted input supplied in the ‘text’ attribute of the wpcbm_best_seller shortcode is stored by the plugin without proper sanitization or escaping. When the badge page is rendered, the injected JavaScript is included in the output and executed in any visitor’s browser. Because the payload runs in the context of the site, an attacker can steal session cookies, deface content, or perform phishing attacks against users who view the page. This flaw does not compromise the server itself but enables client‑side code execution that could undermine user confidentiality and trust.

The Vulnerable Product is the WPC Badge Management for WooCommerce plugin developed by wpclever. All plugin releases up to and including version 3.1.6 are affected. No specific revision numbers are listed beyond the fact that any release with a version number <= 3.1.6 contains the flaw.

The CVSS score of 6.4 indicates a medium severity vulnerability. The EPSS score is reported as < 1 %, indicating a very low probability of exploitation given the current threat landscape. The flaw is not listed in the CISA KEV catalog. Exploitation requires an authenticated user with Contributor level access or higher, who can inject the malicious payload into the text field. Once injected, the script is served to any user who loads the badge page, making this a stored XSS that can be abused client‑side by unauthenticated visitors. Because exploitation is limited to users with sufficient write privileges, the overall attack surface is relatively narrow, but the potential for widespread user exposure remains significant once a badge is published.