The WPC Badge Management for WooCommerce plugin suffers from a stored cross-site scripting vulnerability (CWE-79) in all versions up to 3.1.6. The issue is due to improper neutralization of input during web page generation, specifically in the 'text' attribute of the wpcbm_best_seller shortcode. Authenticated attackers with Contributor-level privileges or above can inject arbitrary JavaScript code that executes in the context of users visiting the compromised pages. This vulnerability could lead to information disclosure or session hijacking but does not affect availability.

An attacker with Contributor-level or higher privileges can exploit this vulnerability to inject malicious scripts that execute in the browsers of users who view the affected pages. This can lead to limited confidentiality and integrity impacts such as theft of user credentials or manipulation of page content. There is no impact on system availability. The vulnerability requires authentication and user interaction to trigger.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Contributor-level access to trusted users only and consider disabling the vulnerable shortcode if possible. Monitor vendor communications for updates regarding a patch or official mitigation.