Stored Cross-Site Scripting in WPC Smart Compare for WooCommerce Plugin

CVE-2025-5530

What is CVE-2025-5530?

The WPC Smart Compare for WooCommerce plugin allows authenticated users with contributor-level access or higher to exploit a vulnerability related to stored cross-site scripting. This occurs through insufficient input sanitization and output escaping of user-supplied attributes in the plugin's 'shortcode_btn' shortcode, enabling attackers to inject arbitrary web scripts. These scripts can be executed on pages whenever they are accessed by users, posing significant security risks.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References