wclovers WCFM Marketplace – Multivendor Marketplace for WooCommerce vulnerabilities

11 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 7 published in the last 12 months.

Latest wclovers WCFM Marketplace – Multivendor Marketplace for WooCommerce vulnerabilities

CVE-2026-18442 — WCFM Marketplace <= 3.8.2 - Unauthenticated SQL Injection via 'wcfmmp_user_location_lat' / 'wcfmmp_user_location_lng' Parameter (CVSS 7.5)
CVE-2026-83562 — WordPress WCFM Marketplace plugin <= 3.8.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
CVE-2026-81286 — WordPress WCFM Marketplace plugin <= 3.8.1 - SQL Injection vulnerability (CVSS 9.3)
CVE-2026-12126 — WCFM Marketplace <= 3.7.3 - Authenticated (Vendor+) Stored Cross-Site Scripting via Attachment 'post_title' (CVSS 6.4)
CVE-2025-63029 — WordPress WCFM Marketplace plugin <= 3.7.1 - SQL Injection vulnerability (CVSS 7.6)
CVE-2026-1722 — WCFM Marketplace <= 3.7.0 - Insecure Direct Object Reference to Unauthenticated Arbitrary Refund Request Creation (CVSS 5.3)
CVE-2025-64631 — WordPress WCFM Marketplace plugin <= 3.7.1 - Broken Access Control vulnerability (CVSS 4.9)
CVE-2024-44009 — WordPress WCFM Marketplace <= 3.6.11 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 6.1)
CVE-2023-4960 — WCFM Marketplace <= 3.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 5.4)
CVE-2022-4936 — WCFM Marketplace <= 3.4.12 - Cross-Site Request Forgery (CVSS 8.8)
CVE-2022-4935 — WCFM Marketplace <= 3.4.11 - Missing Authorization (CVSS 8.8)