CVE-2026-6725

The WPC Smart Messages for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'text' attribute of the wpcsmtextrotator shortcode in all versions up to, and including, 4.2.8. This is due to insufficient input sanitization and output escaping on user supplied...

CVE-2026-6725

CVE-2026-6725 affects the WordPress plugin WPC Smart Messages for WooCommerce (WordPress plugin). The vulnerability is a Stored Cross-Site Scripting (XSS) via the wpcsm_text_rotator shortcode attribute text in all versions up to and including 4.2.8 , caused by insufficient input sanitization and ...

CVE-2026-6725: Improper Neutralization of Input During Web Page Generation

The WPC Smart Messages for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'text' attribute of the wpcsmtextrotator shortcode in all versions up to, and including, 4.2.8. This is due to insufficient input sanitization and output escaping on user supplied...