Wpc Badge Management Vulnerabilities

The WPC Badge Management for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'text' attribute of the `wpcbm_best_seller` shortcode in all versions up to, and including, 3.1.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possi...

CVSS:

6.4

Affected:

up to 3.1.6

Fixed in:

3.1.7

Disclosed:

Jul 28, 2026

CVE-2026-7436 on NVD →

The WPC Badge Management for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'text' attribute of the `wpcbm_best_seller` shortcode in all versions up to, and including, 3.1.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attack...

CVSS:

5.5

Affected:

up to 3.1.6

Fixed in:

3.1.7

Disclosed:

May 12, 2026

CVE-2025-14767 on NVD →

[en] Missing Authorization vulnerability in WPClever WPC Badge Management for WooCommerce.This issue affects WPC Badge Management for WooCommerce: from n/a through 2.4.0.

Affected:

up to 2.4.1

Fixed in:

2.4.1

Disclosed:

Jun 9, 2024

CVE-2024-30537 on NVD →

The WPC Badge Management for WooCommerce plugin for WordPress is vulnerable to unauthorized access due to a missing capability check in versions up to, and including, 2.4.0. This makes it possible for authenticated attackers, with subscriber-level access and above, to perform an unauthorized action.

CVSS:

4.3

Affected:

up to 2.4.0

Fixed in:

2.4.1

Disclosed:

Mar 29, 2024

CVE-2024-30537 on NVD →