The WPC Smart Quick View for WooCommerce plugin for WordPress suffers from a stored cross-site scripting vulnerability (CWE-79) due to improper neutralization of input in the woosq_btn shortcode. Authenticated attackers with contributor-level access or above can inject arbitrary scripts via insufficiently sanitized user-supplied attributes. This vulnerability affects all plugin versions up to and including 4.2.1. The CVSS 3.1 base score is 6.4, reflecting network attack vector, low attack complexity, required privileges, no user interaction, and impacts on confidentiality and integrity with no availability impact. No patch or official vendor advisory is currently available, and no exploits are known in the wild.

Successful exploitation allows authenticated users with contributor-level or higher privileges to inject and store malicious scripts that execute in the context of other users viewing the affected pages. This can lead to unauthorized actions or data disclosure limited to the confidentiality and integrity of the affected WordPress site. There is no reported impact on availability. The vulnerability does not appear to be actively exploited in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level access to trusted users only and consider disabling or removing the WPC Smart Quick View for WooCommerce plugin if feasible. Monitor the vendor's channels for updates or patches addressing this vulnerability.