CVE-2026-7436

Received Received - Intake

Stored XSS in WPC Badge Management for WooCommerce

Publication date: 2026-07-29

Last updated on: 2026-07-29

Assigner: Wordfence

Description

The WPC Badge Management for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'text' attribute of the `wpcbm_best_seller` shortcode in all versions up to, and including, 3.1.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-29

Last Modified

2026-07-29

Generated

2026-08-19

AI Q&A

2026-07-30

EPSS Evaluated

2026-08-18

NVD

CVE-2026-7436

Affected Vendors & Products

Vendor	Product	Version / Range
wpc_badge_management	woocommerce	to 3.1.6 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This vulnerability is a Stored Cross-Site Scripting (XSS) flaw in the WPC Badge Management for WooCommerce WordPress plugin. It allows authenticated attackers with Contributor-level access or higher to inject malicious scripts via the 'text' attribute of the wpcbm_best_seller shortcode. The issue arises from insufficient input sanitization and output escaping.

Detection Guidance

Check WordPress installations for the WPC Badge Management for WooCommerce plugin versions up to 3.1.6. Inspect shortcode usage in posts/pages for the 'wpcbm_best_seller' shortcode with unsanitized 'text' attributes. Review user roles with Contributor-level access or higher for suspicious activity.

Impact Analysis

An attacker could exploit this to inject scripts that execute when users access affected pages. This could lead to theft of session cookies, account takeover, or defacement of the website. Users with Contributor-level access or above could compromise the site and its visitors.

Compliance Impact

This vulnerability could lead to unauthorized access to user data, violating GDPR and HIPAA requirements for data protection and confidentiality. A successful exploit may result in data breaches, triggering legal penalties and compliance violations.

Mitigation Strategies

Update the WPC Badge Management for WooCommerce plugin to the latest version. Remove or sanitize any existing instances of the 'wpcbm_best_seller' shortcode with unsanitized 'text' attributes. Restrict Contributor-level and higher user roles to only trusted users.

Hi! I’m here to help you understand CVE-2026-7436. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70