CVE-2025-5530

Name of the Vulnerable Software and Affected Versions: WPC Smart Compare for WooCommerce versions up to and including 6.4.6

Description: The WPC Smart Compare for WooCommerce plugin for WordPress is susceptible to Stored Cross-Site Scripting through the plugin’s shortcode btn shortcode. Insufficient input sanitization and output escaping on user-supplied attributes allow authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages. These scripts will execute when a user accesses the injected page.

Recommendations: Update WPC Smart Compare for WooCommerce to a version later than 6.4.6.