wclovers WCFM Marketplace – Multivendor Marketplace for WooCommerce

• CVE-2026-18442 High 7.5 WCFM Marketplace <= 3.8.2 - Unauthenticated SQL Injection via 'wcfmmp_user_location_lat' / 'wcfmmp_user_location_lng' Parameter 0.7%
• CVE-2026-12126 Medium 6.4 WCFM Marketplace <= 3.7.3 - Authenticated (Vendor+) Stored Cross-Site Scripting via Attachment 'post_title' 0.4%
• CVE-2026-1722 Medium 5.3 WCFM Marketplace <= 3.7.0 - Insecure Direct Object Reference to Unauthenticated Arbitrary Refund Request Creation 0.3%
• CVE-2023-4960 Medium 6.4 WCFM Marketplace <= 3.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode 0.4%
• CVE-2022-4936 Medium 6.3 WCFM Marketplace <= 3.4.12 - Cross-Site Request Forgery 0.2%
• CVE-2022-4935 High 8.8 WCFM Marketplace <= 3.4.11 - Missing Authorization 0.7%