The WPC Smart Quick View for WooCommerce plugin for WordPress has a security issue where malicious code can be injected into the plugin’s woosq_btn shortcode. This can happen in all versions of the plugin up to version 4.2.1. The problem is caused by not properly checking the information entered by users and not properly protecting the output. This means that attackers who have contributor-level access or higher can insert harmful scripts into pages that will run whenever someone visits that page.