CVE-2026-7436 is a stored cross-site scripting vulnerability in the WPC Badge Management for WooCommerce plugin for WordPress. The issue exists in the 'text' attribute of the wpcbm_best_seller shortcode due to inadequate sanitization and escaping of user input. Authenticated attackers with Contributor-level privileges or higher can exploit this to inject arbitrary scripts that execute in the context of users viewing the injected pages. The vulnerability affects all plugin versions up to and including 3.1.6. No official patch or remediation guidance has been published as of the data provided.

Successful exploitation allows an attacker with Contributor-level access or higher to inject and execute arbitrary JavaScript in the context of users visiting the affected pages. This can lead to theft of user credentials, session hijacking, or other malicious actions limited to the scope of the injected script. The vulnerability does not impact availability and requires authentication with low privileges, but the scope is potentially broad due to stored script execution.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Contributor-level access to trusted users only and consider disabling or removing the WPC Badge Management for WooCommerce plugin if possible. Monitor official vendor channels for updates and apply patches promptly once released.