Wclovers

Wcfm Marketplace

11 Schwachstellen gefunden.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
7.5

CVE-2026-18442

  • EPSS 0.5%
  • Veröffentlicht 18.09.2026 07:39:59
  • Zuletzt bearbeitet 19.09.2026 15:16:58

The WCFM Marketplace – Multivendor Marketplace for WooCommerce plugin for WordPress is vulnerable to generic SQL Injection via the 'wcfmmp_user_location_lng' parameter in all versions up to, and including, 3.8.2 due to insufficient escaping on the us...

6.5

CVE-2026-83562

  • EPSS 0.16%
  • Veröffentlicht 02.09.2026 11:37:31
  • Zuletzt bearbeitet 02.09.2026 13:54:48

Contributor Cross Site Scripting (XSS) in WCFM Marketplace <= 3.8.2 versions.

9.3

CVE-2026-81286

  • EPSS 0.29%
  • Veröffentlicht 02.09.2026 11:37:24
  • Zuletzt bearbeitet 04.09.2026 03:17:42

Unauthenticated SQL Injection in WCFM Marketplace <= 3.8.1 versions.

6.4

CVE-2026-12126

  • EPSS 0.2%
  • Veröffentlicht 11.07.2026 05:35:48
  • Zuletzt bearbeitet 13.07.2026 16:59:13

The WCFM Marketplace – Multivendor Marketplace for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Attachment 'post_title' in all versions up to, and including, 3.7.3 due to insufficient input sanitization and output...

7.6

CVE-2025-63029

  • EPSS 0.27%
  • Veröffentlicht 15.04.2026 16:21:23
  • Zuletzt bearbeitet 07.10.2026 09:10:00

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WC Lovers WCFM Marketplace wc-multivendor-marketplace allows SQL Injection.This issue affects WCFM Marketplace: from n/a through <= 3.7.1.

5.3

CVE-2026-1722

  • EPSS 0.29%
  • Veröffentlicht 10.02.2026 07:27:00
  • Zuletzt bearbeitet 15.04.2026 00:35:42

The WCFM Marketplace – Multivendor Marketplace for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.7.0. This is due to the plugin not implementing authorization checks in the ...

4.9

CVE-2025-64631

  • EPSS 0.34%
  • Veröffentlicht 16.12.2025 08:12:50
  • Zuletzt bearbeitet 27.04.2026 16:16:42

Missing Authorization vulnerability in WC Lovers WCFM Marketplace wc-multivendor-marketplace allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WCFM Marketplace: from n/a through <= 3.7.1.

6.1

CVE-2024-44009

  • EPSS 0.31%
  • Veröffentlicht 17.09.2024 23:15:19
  • Zuletzt bearbeitet 23.04.2026 15:18:58

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WC Lovers WCFM Marketplace wc-multivendor-marketplace allows Reflected XSS.This issue affects WCFM Marketplace: from n/a through <= 3.6.11.

5.4

CVE-2023-4960

  • EPSS 0.44%
  • Veröffentlicht 11.01.2024 09:15:46
  • Zuletzt bearbeitet 08.04.2026 19:18:40

The WCFM Marketplace plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'wcfm_stores' shortcode in versions up to, and including, 3.6.2 due to insufficient input sanitization and output escaping on user supplied attributes. This ma...

8.8

CVE-2022-4935

  • EPSS 0.72%
  • Veröffentlicht 05.04.2023 18:15:07
  • Zuletzt bearbeitet 08.04.2026 18:17:36

The WCFM Marketplace plugin for WordPress is vulnerable to unauthorized modification and access of data in versions up to, and including, 3.4.11 due to missing capability checks on various AJAX actions. This makes it possible for authenticated attack...