Stored Cross-Site Scripting in WPC Smart Compare for WooCommerce Plugin by WordPress

CVE-2025-7496

What is CVE-2025-7496?

The WPC Smart Compare for WooCommerce plugin is vulnerable to Stored Cross-Site Scripting (XSS) due to inadequate input sanitization and output escaping across all versions up to and including 6.4.7. This vulnerability allows authenticated users with Contributor-level access or higher to inject malicious web scripts into pages, which may execute when users access the compromised pages, potentially compromising user data and site integrity.

References