CVE-2025-14767: WPC Badge Management WooCommerce XSS Flaw

CVE-2025-14767 Overview

CVE-2025-14767 is a stored Cross-Site Scripting (XSS) vulnerability in the WPC Badge Management for WooCommerce plugin for WordPress. The flaw affects all versions up to and including 3.1.6. It resides in the text attribute of the wpcbm_best_seller shortcode, where insufficient input sanitization and output escaping allow script injection. Authenticated attackers with Shop Manager-level access or above can inject arbitrary JavaScript that executes when users visit affected pages. The issue is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation).

Critical Impact
Authenticated Shop Managers can persistently inject JavaScript into WooCommerce pages, enabling session theft, administrative action abuse, and storefront defacement against any visitor.

Affected Products

WPC Badge Management for WooCommerce plugin (WordPress)
All versions up to and including 3.1.6
WordPress sites using the wpcbm_best_seller shortcode

Discovery Timeline

2026-05-13 - CVE-2025-14767 published to NVD
2026-05-13 - Last updated in NVD database

Technical Details for CVE-2025-14767

Vulnerability Analysis

The vulnerability exists in the shortcode handler implemented in class-shortcode.php of the WPC Badge Management for WooCommerce plugin. The wpcbm_best_seller shortcode accepts a text attribute that is rendered directly into page output. The plugin fails to apply WordPress sanitization functions such as sanitize_text_field() on input or escaping functions such as esc_html() or esc_attr() on output. As a result, HTML and JavaScript supplied through the text attribute persist in the database and execute in the browser of any visitor rendering the affected page or post.

The attack requires authenticated access at the Shop Manager role or higher, which limits exploitation to users already trusted with WooCommerce store management. However, Shop Manager accounts are commonly delegated to staff and third-party vendors, expanding the practical attack surface. Successful exploitation occurs in the victim's browser context, allowing the attacker to perform actions as the visiting user, including administrators.

Root Cause

The root cause is missing input sanitization and missing output escaping for a user-controllable shortcode attribute. The vulnerable code path is referenced at line 98 of includes/class-shortcode.php in the plugin source. The fix was committed in changeset 3519100.

Attack Vector

An attacker with Shop Manager privileges inserts the wpcbm_best_seller shortcode into a post, page, or product description with a malicious text attribute containing JavaScript payloads. When any user, including unauthenticated visitors and administrators, loads the page, the injected script executes. The scope is changed (S:C), meaning the impact extends beyond the vulnerable component to the browser security context of every visitor. Attackers can hijack sessions, exfiltrate cookies, or trigger CSRF actions against higher-privileged users.

No verified proof-of-concept code has been published. Refer to the Wordfence vulnerability report for additional technical context.

Detection Methods for CVE-2025-14767

Indicators of Compromise

Presence of [wpcbm_best_seller ...] shortcodes containing <script>, onerror=, onload=, or javascript: payloads in wp_posts content.
Outbound browser requests from site visitors to unfamiliar domains immediately after rendering pages containing the shortcode.
Unexpected modifications to posts or products performed by Shop Manager accounts.
New or altered administrator accounts created shortly after a Shop Manager edits content.

Detection Strategies

Query the WordPress database for shortcode instances: SELECT ID, post_title FROM wp_posts WHERE post_content LIKE '%wpcbm_best_seller%'; and review the text attribute values.
Inspect web server access logs for POST requests to wp-admin/post.php originating from Shop Manager accounts followed by anomalous client-side traffic.
Use a web application firewall to flag shortcode attributes containing HTML tags or script keywords.

Monitoring Recommendations

Enable WordPress audit logging for post and product edits performed by non-administrator roles.
Monitor browser-side errors and Content Security Policy (CSP) violations reported through CSP report-uri endpoints.
Alert on creation of new privileged accounts and on changes to the active WooCommerce plugin set.

How to Mitigate CVE-2025-14767

Immediate Actions Required

Update the WPC Badge Management for WooCommerce plugin to a version newer than 3.1.6 that includes changeset 3519100.
Audit all existing usage of the wpcbm_best_seller shortcode and remove any unexpected HTML or script content from the text attribute.
Review Shop Manager account membership and revoke access for unused or third-party accounts.
Rotate session cookies and force re-authentication for all WordPress users after remediation.

Patch Information

The vendor patched the vulnerability in the plugin trunk via changeset 3519100. Administrators should install the latest release from the official plugin page and verify that the installed version is greater than 3.1.6.

Workarounds

Deactivate the WPC Badge Management for WooCommerce plugin until the patched version is installed.
Restrict Shop Manager role assignments to a minimum and enforce multi-factor authentication on those accounts.
Deploy a Content Security Policy that disallows inline scripts to limit the impact of stored XSS payloads.
Use a WordPress security plugin or WAF rule to block shortcode attributes containing <, >, or javascript: substrings.

bash

# Example WP-CLI commands to identify and remediate affected content
wp plugin update wpc-badge-management
wp db query "SELECT ID, post_title FROM wp_posts WHERE post_content LIKE '%wpcbm_best_seller%';"
wp plugin deactivate wpc-badge-management   # Temporary workaround if patching is delayed