CVE-2026-7436

MediumCVSS 6.4

Published: 29/07/2026(UTC)Updated: 30/07/2026(UTC)Translated: 29/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.19%

9th percentile - higher than 9% of all known CVEs

Summary

The WPC Badge Management for WooCommerce plugin for WordPress is vulnerable to Stored XSS via the 'text' attribute of the `wpcbm_best_seller` shortcode. Insufficient input sanitization and output escaping allow authenticated users (Contributor and above) to inject arbitrary JavaScript. Affects versions up to 3.1.6.

Risk Assessment

An attacker can inject scripts that execute on pages visited by other users, potentially leading to data theft or account takeover.

Recommendation

Update the WPC Badge Management for WooCommerce plugin to the latest version.

Other vulnerabilities in WPC Badge Management for WooCommerce

CVE-2025-14767Medium
The WPC Badge Management for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'text' attribute of the `wpcbm_best_seller` shortcode in all versions up to, and including, 3.1.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Shop Manager-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Original NVD description (English source)

The WPC Badge Management for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'text' attribute of the `wpcbm_best_seller` shortcode in all versions up to, and including, 3.1.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS