The WPC Smart Quick View for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin’s woosq_btn shortcode in all versions up to, and including, 4.2.1. This vulnerability arises from insufficient input sanitization and output escaping on user-supplied attributes, allowing authenticated attackers with contributor-level access and above to inject arbitrary web scripts that execute when a user accesses the affected page.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 6.4 | CVE-2025-8618 |
Exploitation
To exploit this vulnerability, an attacker with contributor-level access can craft a malicious payload and inject it into the woosq_btn shortcode. When a user accesses a page containing this shortcode, the injected script will execute in the context of the user’s browser, potentially leading to session hijacking or other malicious actions.
Affected Products
- WPC Smart Quick View for WooCommerce: A plugin for WordPress that allows users to view product details quickly. The vulnerability affects all versions up to and including 4.2.1.
Mitigation
To mitigate this vulnerability, users should update the WPC Smart Quick View for WooCommerce plugin to the latest version where the issue has been addressed. Additionally, implementing proper input sanitization and output escaping practices in custom code can help prevent similar vulnerabilities.