CVE-2026-7436 in WPC Badge Management for WooCommerce Plugin
Summary
by MITRE • 07/29/2026
The WPC Badge Management for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'text' attribute of the `wpcbm_best_seller` shortcode in all versions up to, and including, 3.1.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 07/29/2026
The vulnerability in the WPC Badge Management for WooCommerce plugin represents a critical stored cross-site scripting weakness that affects versions up to and including 3.1.6. This issue stems from inadequate input validation and output escaping mechanisms within the plugin's shortcode implementation, specifically targeting the 'text' attribute of the wpcbm_best_seller shortcode. The flaw allows authenticated attackers who possess contributor-level privileges or higher to execute malicious code through crafted input that gets stored and subsequently executed in user browsers.
The technical exploitation of this vulnerability occurs when an attacker with sufficient permissions creates or modifies content using the affected shortcode parameter. The plugin fails to properly sanitize the 'text' attribute before storing it in the database, and does not adequately escape the output when rendering pages that contain this stored data. This creates a persistent XSS vector where malicious scripts injected through the shortcode parameters can execute whenever any user accesses pages containing the compromised content.
From an operational perspective, this vulnerability poses significant risks to WordPress installations using the affected plugin. Since contributors and above have the ability to modify content, attackers can leverage this privilege to inject malicious JavaScript payloads that could steal session cookies, redirect users to malicious sites, or perform other harmful actions. The stored nature of the vulnerability means that victims do not need to be actively browsing the compromised page for exploitation to occur, as the malicious code is already present in the database and executes on page load.
The security implications extend beyond simple script execution, as this vulnerability aligns with CWE-79 which describes improper neutralization of input during web page generation. The ATT&CK framework categorizes this as a form of client-side code injection where attackers can manipulate user sessions or data through compromised web applications. Organizations using WooCommerce plugins must consider the broader impact of such vulnerabilities in their supply chain security, particularly when dealing with plugins that manage product badges and user-facing content.
Mitigation strategies should prioritize immediate plugin updates to versions that address the sanitization and escaping deficiencies. Administrators should also implement additional security measures including role-based access controls, regular security audits of plugin installations, and monitoring for unauthorized content modifications. The vulnerability highlights the importance of proper input validation and output escaping practices in web application development, particularly for plugins that handle user-supplied data in contexts where it will be rendered to other users.