The WPC Smart Compare for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via DOM elements in all versions up to, and including, 6.4.7 due to insufficient input sanitization and output escaping. This vulnerability allows authenticated attackers with Contributor-level access and above to inject arbitrary web scripts into pages. These scripts will execute whenever a user accesses an injected page.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 6.4 | CVE-2025-7496 |
Exploitation
To exploit this vulnerability, an attacker with Contributor-level access can craft a malicious script and inject it into the plugin’s input fields. When a user accesses the affected page, the script will execute in their browser, potentially leading to data theft or session hijacking.
Affected Products
- The WPC Smart Compare for WooCommerce plugin (versions up to 6.4.7): This plugin allows users to compare products in WooCommerce but is vulnerable to XSS attacks due to insufficient input validation.
Mitigation
To mitigate this vulnerability, users should update the WPC Smart Compare for WooCommerce plugin to the latest version where the issue has been addressed. Additionally, implementing proper input sanitization and output escaping practices can help prevent similar vulnerabilities in the future.