Log in Start free

WC Lovers

Products

ProductCVEsExploitedLatest
WCFM Marketplace8–Nov 7, 2026
WCFM Membership6–Nov 7, 2026
WCFM – Frontend Manager for WooCommerce2–Dec 16, 2025
WooCommerce Frontend Manager – Ultimate1–Jun 17, 2026
WooCommerce Multivendor Marketplace – REST API1–Oct 6, 2026

Exploited and recent CVEs

  • CVE-2026-61990 Medium 4.3 WordPress WCFM Membership plugin <= 2.12.0 - Broken Access Control vulnerability –
  • CVE-2026-120849 Medium 4.3 WordPress WCFM Marketplace plugin <= 3.8.3 - Broken Access Control vulnerability –
  • CVE-2026-120848 Medium 6.5 WordPress WCFM Marketplace plugin <= 3.8.3 - Cross Site Scripting (XSS) vulnerability –
  • CVE-2026-62000 High 7.5 WordPress WCFM Marketplace plugin <= 3.8.2 - Broken Access Control vulnerability 0.2%
  • CVE-2026-39777 Medium 4.3 WordPress WCFM Membership plugin <= 2.12.0 - Broken Access Control vulnerability 0.2%
  • CVE-2026-39743 Medium 5.3 WordPress WCFM Membership plugin <= 2.12.0 - Broken Access Control vulnerability 0.2%
  • CVE-2026-39794 High 7.5 WordPress WooCommerce Multivendor Marketplace – REST API plugin <= 1.6.3 - Broken Access Control vulnerability 0.4%
  • CVE-2026-32480 Medium 5.3 WordPress WCFM Membership plugin <= 2.11.11 - Broken Access Control vulnerability 0.3%
  • CVE-2026-84756 High 7.1 WordPress WCFM Membership plugin <= 2.11.11 - Privilege Escalation vulnerability 0.3%
  • CVE-2026-83562 Medium 6.5 WordPress WCFM Marketplace plugin <= 3.8.2 - Cross Site Scripting (XSS) vulnerability 0.2%
  • CVE-2026-81286 Critical 9.3 WordPress WCFM Marketplace plugin <= 3.8.1 - SQL Injection vulnerability 0.4%
  • CVE-2026-22335 High 8.5 WordPress WooCommerce Frontend Manager – Ultimate plugin < 6.7.7 - SQL Injection vulnerability 0.3%
  • CVE-2026-42753 High 7.3 WordPress WCFM Membership plugin <= 2.11.10 - Broken Access Control vulnerability 0.2%
  • CVE-2025-63029 High 7.6 WordPress WCFM Marketplace plugin <= 3.7.1 - SQL Injection vulnerability 0.3%
  • CVE-2025-64631 Medium 4.9 WordPress WCFM Marketplace plugin <= 3.7.1 - Broken Access Control vulnerability 0.3%
  • CVE-2025-54004 Low 2.7 WordPress WCFM – Frontend Manager for WooCommerce plugin <= 6.7.24 - Broken Access Control vulnerability 0.3%
  • CVE-2024-44009 High 7.1 WordPress WCFM Marketplace <= 3.6.11 - Reflected Cross Site Scripting (XSS) vulnerability 0.3%
  • CVE-2024-29929 Medium 5.9 WordPress WCFM plugin <= 6.7.8 - Cross Site Scripting (XSS) vulnerability 0.4%