CVE-2026-7436: WPC Badge Management XSS Vulnerability

CVE-2026-7436 Overview

CVE-2026-7436 is a Stored Cross-Site Scripting (XSS) vulnerability affecting the WPC Badge Management for WooCommerce plugin for WordPress. The flaw exists in all versions up to and including 3.1.6. It stems from insufficient input sanitization and output escaping on the text attribute of the wpcbm_best_seller shortcode. Authenticated attackers with Contributor-level access or higher can inject arbitrary web scripts into pages. Injected scripts execute in the browser of any user who visits the affected page, enabling session theft, redirection, and defacement.

Critical Impact
Contributor-level users can inject persistent JavaScript payloads that execute against site visitors, including administrators, leading to session hijacking and privilege escalation risk.

Affected Products

WPC Badge Management for WooCommerce plugin for WordPress
All versions up to and including 3.1.6
WordPress sites using the wpcbm_best_seller shortcode

Discovery Timeline

2026-07-29 - CVE-2026-7436 published to the National Vulnerability Database
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-7436

Vulnerability Analysis

The vulnerability is a Stored Cross-Site Scripting flaw categorized under [CWE-79]. The wpcbm_best_seller shortcode accepts a text attribute that is rendered into page output without adequate sanitization or escaping. An authenticated user with Contributor role or higher can embed the shortcode within post content and pass JavaScript payloads through the text attribute. When any visitor loads the resulting page, the browser parses the injected script in the context of the WordPress site origin.

Because the payload persists in the database, the attack surface extends to every subsequent view of the affected content. If an administrator loads the page, the attacker gains the ability to perform actions in the admin session, including creating new administrator accounts or modifying plugin configuration.

Root Cause

The root cause resides in the shortcode handler located in includes/class-shortcode.php around line 141. The handler concatenates the user-supplied text attribute into HTML output without invoking WordPress escaping functions such as esc_html(), esc_attr(), or wp_kses(). Contributor-role users have the capability to author posts containing shortcodes, so the attribute value flows from an untrusted source directly into the DOM.

Attack Vector

Exploitation requires network access and authenticated access at Contributor privilege or higher. The attacker creates or edits a post containing the wpcbm_best_seller shortcode with a malicious text attribute. Once the post is submitted or previewed by any user, the injected script executes. The scope is changed because the payload runs in the browser context of visitors, extending impact beyond the vulnerable component.

Refer to the Wordfence Vulnerability Analysis and the WordPress Plugin Source Code for technical details on the vulnerable code path.

Detection Methods for CVE-2026-7436

Indicators of Compromise

Posts or pages containing the wpcbm_best_seller shortcode with a text attribute holding <script>, onerror=, onload=, or javascript: payloads
Unexpected outbound HTTP requests from browsers of authenticated users to attacker-controlled domains after viewing pages that render the shortcode
New administrator accounts, modified user roles, or unexpected plugin installations following visits to affected pages

Detection Strategies

Query the wp_posts table for content matching regular expressions that combine the shortcode name wpcbm_best_seller with common XSS syntax such as angle brackets or event handler attributes
Review WordPress audit logs for post creation or edit events by Contributor-level accounts that reference the wpcbm_best_seller shortcode
Inspect rendered HTML of pages using the shortcode to confirm that the text attribute output is properly escaped

Monitoring Recommendations

Monitor authentication and role-assignment events for anomalous elevation of Contributor accounts to Editor or Administrator
Track browser-side telemetry for outbound requests originating from WordPress-rendered pages to unknown domains
Alert on file changes within the wp-content/plugins/wpc-badge-management/ directory and on new administrative user creation

How to Mitigate CVE-2026-7436

Immediate Actions Required

Update the WPC Badge Management for WooCommerce plugin to a version later than 3.1.6 once released by the vendor
Audit all existing posts and pages for the wpcbm_best_seller shortcode and remove or sanitize any malicious text attribute values
Review Contributor and Author role assignments and remove accounts that do not require content authoring privileges

Patch Information

The fix is tracked in the plugin repository. Review the WordPress Plugin Changeset for the corrective commit and consult the WordPress Plugin Page for the latest release.

Workarounds

Deactivate the WPC Badge Management for WooCommerce plugin until a patched version is installed
Restrict the ability to author posts containing shortcodes by removing the unfiltered_html capability review and downgrading untrusted Contributor accounts
Deploy a Web Application Firewall rule that inspects post content for the wpcbm_best_seller shortcode combined with script-injection patterns and blocks submissions

bash

# Example WP-CLI query to identify posts containing the vulnerable shortcode
wp db query "SELECT ID, post_title, post_author FROM wp_posts \
  WHERE post_content LIKE '%[wpcbm_best_seller%' \
  AND (post_content LIKE '%<script%' \
       OR post_content LIKE '%onerror=%' \
       OR post_content LIKE '%javascript:%');"