CVE-2025-14767

Name of the Vulnerable Software and Affected Versions WPC Badge Management for WooCommerce versions prior to 3.1.7

Description The WPC Badge Management for WooCommerce plugin for WordPress contains a Stored Cross-Site Scripting issue. This occurs due to insufficient input sanitization and output escaping within the text attribute of the wpcbm best seller shortcode. Authenticated attackers with Shop Manager-level access or higher can inject arbitrary web scripts into pages, which then execute when a user visits the affected page.

Recommendations Update the plugin to a version later than 3.1.6.