CVE-2025-14767

🗓️ 13 May 2026 07:44:11Reported by WordfenceType

Authenticated Shop Manager can exploit stored cross site scripting via the wpcbm_best_seller text attribute in WPC Badge Management for WooCommerce up to 3.1.6.

Reporter	Title	Published	Views	Family All 10
ATTACKERKB	CVE-2025-14767	13 May 202607:44	–	attackerkb
Circl	CVE-2025-14767	16 May 202617:32	–	circl
CNNVD	WordPress plugin WPC Badge Management for WooCommerce 跨站脚本漏洞	13 May 202600:00	–	cnnvd
Cvelist	CVE-2025-14767 WPC Badge Management for WooCommerce <= 3.1.6 - Authenticated (Shop Manager+) Stored Cross-Site Scripting via 'text' Attribute	13 May 202607:44	–	cvelist
EUVD	EUVD-2025-209823	13 May 202607:44	–	euvd
NVD	CVE-2025-14767	13 May 202608:16	–	nvd
Patchstack	WordPress WPC Badge Management for WooCommerce plugin <= 3.1.6 - Authenticated (Shop Manager+) Stored Cross-Site Scripting vulnerability	12 May 202600:00	–	patchstack
Positive Technologies	PT-2026-40581	13 May 202600:00	–	ptsecurity
RedhatCVE	CVE-2025-14767	5 Jun 202619:42	–	redhatcve
Vulnrichment	CVE-2025-14767 WPC Badge Management for WooCommerce <= 3.1.6 - Authenticated (Shop Manager+) Stored Cross-Site Scripting via 'text' Attribute	13 May 202607:44	–	vulnrichment

Vulners

Node

wpclever wpc_badge_management_for_woocommerceRange≤3.1.6wordpress

[
  {
    "vendor": "wpclever",
    "product": "WPC Badge Management for WooCommerce",
    "versions": [
      {
        "version": "0",
        "status": "affected",
        "lessThanOrEqual": "3.1.6",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
plugins	www.plugins.trac.wordpress.org/changeset/3519100/
wordpress	www.wordpress.org/plugins/wpc-badge-management
plugins	www.plugins.trac.wordpress.org/browser/wpc-badge-management/trunk/includes/class-shortcode.php
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/bf02edc9-2bb6-4ceb-b2a1-63f95c8becb3

13 May 2026 14:43Current

6Medium risk

Vulners AI Score6

CVSS 3.15.5

EPSS0.00037

SSVC

CWE-79