CVE-2026-7436

Name of the Vulnerable Software and Affected Versions WPC Badge Management for WooCommerce versions prior to 3.1.7

Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping on user-supplied attributes. Authenticated attackers with Contributor-level access and above can inject arbitrary web scripts through the text attribute of the wpcbm best seller shortcode. These scripts execute whenever a user accesses the affected page.

Recommendations Update WPC Badge Management for WooCommerce to a version newer than 3.1.6. As a temporary mitigation, restrict the ability of users with Contributor-level access to edit pages or use the wpcbm best seller shortcode.