Stored Cross-Site Scripting Vulnerability in WPC Smart Quick View for WooCommerce Plugin

CVE-2025-8618

What is CVE-2025-8618?

The WPC Smart Quick View for WooCommerce plugin for WordPress is susceptible to stored cross-site scripting. This vulnerability arises from inadequate input sanitization and output escaping on user-defined attributes used within the plugin's woosq_btn shortcode. Authenticated attackers with contributor-level permissions and higher can inject malicious scripts into web pages. When other users visit these compromised pages, the injected scripts execute, potentially compromising sensitive information and user sessions.

References