wclovers WCFM – Frontend Manager for WooCommerce

• CVE-2026-10041 Medium 4.3 WCFM – Frontend Manager for WooCommerce <= 6.7.27 - Authenticated (Subscriber+) Missing Authorization to Arbitrary Vendor Data Manipulation via Multiple AJAX Handlers 0.4%
• CVE-2026-12994 Medium 5.3 WCFM – Frontend Manager for WooCommerce <= 6.7.27 - Missing Authorization to Unauthenticated Arbitrary Inquiry Reply Injection via wcfm-my-account-enquiry-manage Controller 0.6%
• CVE-2026-2554 High 8.1 WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible <= 6.7.25 - Authenticated (Vendor+) Insecure Direct Object Reference to Arbitrary User Deletion 0.3%
• CVE-2026-4896 High 8.1 WCFM - WooCommerce Frontend Manager <= 6.7.25 - Insecure Direct Object References to Autenticated (Vendor+) Arbitrary Post/Product Manipulation 0.4%
• CVE-2026-0845 High 7.2 WCFM - WooCommerce Frontend Manager <= 6.7.24 - Authenticated (Shop Manager+) Arbitrary Options Update 0.5%
• CVE-2025-3780 Medium 6.5 WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible <= 6.7.16 - Missing Authorization to Unauthenticated Plugin Settings Modification 0.3%
• CVE-2024-8290 High 8.8 WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible <= 6.7.12 - Insecure Direct Object Reference to Account Takeover/Privilege Escalation 0.6%
• CVE-2022-4938 Medium 6.3 WCFM Frontend Manager <= 6.5.13 - Cross-Site Request Forgery 0.2%