CVE-2025-5530: WPC Smart Compare XSS Vulnerability

CVE-2025-5530 Overview

CVE-2025-5530 is a Stored Cross-Site Scripting (XSS) vulnerability in the WPC Smart Compare for WooCommerce plugin for WordPress. The flaw resides in the plugin's shortcode_btn shortcode and affects all versions up to and including 6.4.6. Insufficient input sanitization and output escaping on user-supplied attributes allow authenticated attackers with contributor-level access or higher to inject arbitrary JavaScript. Injected scripts execute in the browser of any user who visits an affected page. The issue is tracked under CWE-79 and was published to the National Vulnerability Database (NVD) on July 11, 2025.

Critical Impact
Contributor-level accounts can persist malicious JavaScript in WordPress pages, enabling session theft, account takeover, and redirection of site visitors.

Affected Products

WPC Smart Compare for WooCommerce plugin, all versions up to and including 6.4.6
WordPress sites running the vulnerable plugin with WooCommerce enabled
Deployments that grant contributor-level or higher roles to untrusted users

Discovery Timeline

2025-07-11 - CVE-2025-5530 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-5530

Vulnerability Analysis

The vulnerability affects the shortcode_btn shortcode implementation inside wpc-smart-compare.php. When a contributor embeds the shortcode in a post or page, attacker-controlled attributes are rendered into HTML output without proper escaping. The plugin renders the value directly into markup, allowing script tags, event handlers, or javascript: URIs to persist in the database and execute on page load.

Because the payload is stored, every visitor rendering the affected page triggers execution in their browser session. The scope change on execution means an attacker with low privileges can affect higher-privileged users, including administrators who preview or moderate contributor content.

Root Cause

The root cause is missing input sanitization on shortcode attributes and missing output escaping when those attributes are echoed into HTML. The plugin does not apply WordPress escaping helpers such as esc_attr(), esc_html(), or wp_kses() to attacker-supplied values referenced at lines 187 and 2616 of wpc-smart-compare.php in the 6.4.5 tag. This is a classic instance of CWE-79: Improper Neutralization of Input During Web Page Generation.

Attack Vector

Exploitation requires an authenticated account with contributor privileges or higher. The attacker crafts a post containing the shortcode_btn shortcode with a malicious attribute value carrying JavaScript. Once the content is saved and rendered, any authenticated user or site visitor loading the page executes the payload in their browser context. Refer to the Wordfence Vulnerability Report and the WordPress Change Set for the fix details.

No public exploit code is available in Exploit-DB, and the CVE is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2025-5530

Indicators of Compromise

Posts or pages containing [shortcode_btn] invocations with attribute values that include <script>, onerror=, onload=, or javascript: strings
Unexpected outbound requests from visitor browsers to unfamiliar domains after loading product comparison pages
New administrator accounts, modified user roles, or altered plugin/theme files following contributor content submissions
WordPress wp_posts rows authored by contributors that reference the WPC Smart Compare shortcode with encoded HTML entities

Detection Strategies

Query the WordPress database for stored shortcode attributes containing scripting primitives: SELECT ID, post_author FROM wp_posts WHERE post_content LIKE '%shortcode_btn%' AND post_content REGEXP '(<script|on[a-z]+=|javascript:)'
Review Web Application Firewall (WAF) logs for POST requests to wp-admin/post.php or the REST API from contributor-role sessions containing script payloads
Monitor endpoint browser telemetry for anomalous script execution on /product-comparison/ or similar pages that render the shortcode

Monitoring Recommendations

Enable file integrity monitoring on the wp-content/plugins/woo-smart-compare/ directory
Alert on privilege escalations and new administrator user creation after contributor content publication
Forward WordPress audit logs to a centralized SIEM for correlation of contributor activity with post-modification events

How to Mitigate CVE-2025-5530

Immediate Actions Required

Update the WPC Smart Compare for WooCommerce plugin to a version later than 6.4.6 as soon as the vendor releases a patched build
Audit contributor and author accounts, revoking privileges for untrusted or dormant users
Review existing posts and pages for malicious shortcode_btn invocations and remove tainted content

Patch Information

The vendor addressed the issue in the plugin repository. Consult the WordPress Change Set and the Wordfence Vulnerability Report for the corrected code. Site administrators should upgrade through the WordPress plugin manager and confirm the version reported under Plugins → Installed Plugins.

Workarounds

Disable the WPC Smart Compare for WooCommerce plugin until it is patched
Restrict the ability to publish posts containing shortcodes by limiting contributor and author roles through a role-management plugin
Deploy a WAF rule that blocks POST requests containing shortcode_btn attributes with script tags or event handlers
Enforce a Content Security Policy (CSP) that disallows inline scripts on public-facing pages

bash

# Example WP-CLI commands to inventory and disable the vulnerable plugin
wp plugin list --name=woo-smart-compare --fields=name,status,version
wp plugin deactivate woo-smart-compare
wp post list --post_type=any --s='shortcode_btn' --fields=ID,post_author,post_status