The WPC Smart Quick View for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin’s woosq_btn shortcode in all versions up to, and including, 4.2.1. This vulnerability arises from insufficient input sanitization and output escaping on user-supplied attributes, allowing authenticated attackers with contributor-level access and above to inject arbitrary web scripts that execute when a user accesses the affected page.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 6.4 | CVE-2025-8618 |
Exploitation
To exploit this vulnerability, an attacker with contributor-level access can craft a malicious shortcode using the woosq_btn shortcode, injecting arbitrary JavaScript code. When a user accesses a page containing this shortcode, the injected script will execute in the context of the user’s browser, potentially leading to session hijacking or other malicious actions.
Affected Products
- WPC Smart Quick View for WooCommerce: A WordPress plugin that allows users to view product details quickly, which is vulnerable to XSS attacks due to improper handling of user input.
Mitigation
To mitigate this vulnerability, it is recommended to update the WPC Smart Quick View for WooCommerce plugin to the latest version where the issue has been addressed. Additionally, implementing proper input sanitization and output escaping practices can help prevent similar vulnerabilities in the future.