Wwclovers

Products

Exploited and recent CVEs

• CVE-2026-18442 High 7.5 WCFM Marketplace <= 3.8.2 - Unauthenticated SQL Injection via 'wcfmmp_user_location_lat' / 'wcfmmp_user_location_lng' Parameter 0.7%
• CVE-2026-10041 Medium 4.3 WCFM – Frontend Manager for WooCommerce <= 6.7.27 - Authenticated (Subscriber+) Missing Authorization to Arbitrary Vendor Data Manipulation via Multiple AJAX Handlers 0.4%
• CVE-2026-12126 Medium 6.4 WCFM Marketplace <= 3.7.3 - Authenticated (Vendor+) Stored Cross-Site Scripting via Attachment 'post_title' 0.4%
• CVE-2026-12994 Medium 5.3 WCFM – Frontend Manager for WooCommerce <= 6.7.27 - Missing Authorization to Unauthenticated Arbitrary Inquiry Reply Injection via wcfm-my-account-enquiry-manage Controller 0.6%
• CVE-2026-3688 High 8.1 WCFM - WooCommerce Multivendor Membership <= 2.11.10 - Insecure Direct Object Reference to Limited Privilege Escalation via User Role Overwrite 0.4%
• CVE-2026-2554 High 8.1 WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible <= 6.7.25 - Authenticated (Vendor+) Insecure Direct Object Reference to Arbitrary User Deletion 0.3%
• CVE-2026-4896 High 8.1 WCFM - WooCommerce Frontend Manager <= 6.7.25 - Insecure Direct Object References to Autenticated (Vendor+) Arbitrary Post/Product Manipulation 0.4%
• CVE-2026-1722 Medium 5.3 WCFM Marketplace <= 3.7.0 - Insecure Direct Object Reference to Unauthenticated Arbitrary Refund Request Creation 0.3%
• CVE-2025-15147 Medium 4.3 WCFM Membership – WooCommerce Memberships for Multivendor Marketplace <= 2.11.8 - Insecure Direct Object Reference to Update Membership Payment 0.3%
• CVE-2026-0845 High 7.2 WCFM - WooCommerce Frontend Manager <= 6.7.24 - Authenticated (Shop Manager+) Arbitrary Options Update 0.5%
• CVE-2025-3780 Medium 6.5 WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible <= 6.7.16 - Missing Authorization to Unauthenticated Plugin Settings Modification 0.3%
• CVE-2025-1311 Medium 6.5 WooCommerce Multivendor Marketplace – REST API <= 1.6.2 - Authenticated (Subscriber+) SQL Injection 0.4%
• CVE-2024-8290 High 8.8 WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible <= 6.7.12 - Insecure Direct Object Reference to Account Takeover/Privilege Escalation 0.6%
• CVE-2023-4960 Medium 6.4 WCFM Marketplace <= 3.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode 0.4%
• CVE-2023-2275 Medium 4.3 WooCommerce Multivendor Marketplace – REST API <= 1.5.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Order/Order Note Disclosure, Order Note Addition via REST API 0.5%
• CVE-2023-2276 Critical 9.8 WCFM Membership – WooCommerce Memberships for Multivendor Marketplace <= 2.10.7 - Unauthenticated Insecure Direct Object Reference to Arbitrary User Password Change 1.1%
• CVE-2022-4941 Medium 6.3 WCFM Membership <= 2.9.10 - Cross-Site Request Forgery 0.3%
• CVE-2022-4940 High 7.3 WCFM Membership <= 2.10.0 - Missing Authorization 1.1%
• CVE-2022-4939 Critical 9.8 WCFM Membership <= 2.10.0 - Unauthenticated Privilege Escalation 2.1%
• CVE-2022-4938 Medium 6.3 WCFM Frontend Manager <= 6.5.13 - Cross-Site Request Forgery 0.2%
• CVE-2022-4937 Medium 6.3 The WCFM Frontend Manager plugin for WordPress is vulnerable to unauthorized modification and access of data in versions up to, and including, 6.6.0 due to missing capability checks on various AJAX ac 0.6%
• CVE-2022-4936 Medium 6.3 WCFM Marketplace <= 3.4.12 - Cross-Site Request Forgery 0.2%
• CVE-2022-4935 High 8.8 WCFM Marketplace <= 3.4.11 - Missing Authorization 0.7%