sales@hackhalt.com
Free Download

Live Vulnerability Intelligence

Threat Database

Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.

Total14
Critical1
High3
Medium10
Reset
Showing 1-14 of 14 records
Threat Entry Updated 2026-09-19

WCFM Marketplace - Security Vulnerability (CVE-2026-18442)

The WCFM Marketplace – Multivendor Marketplace for WooCommerce plugin for WordPress is vulnerable to generic SQL Injection via the 'wcfmmp_user_location_lng' parameter in all versions up to, and including, 3.8.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

PLUGIN WCFM Marketplace

CVE-2026-18442

HIGH CVSS 7.5 2026-09-18
Open Full Technical Breakdown
Threat Entry Updated 2026-08-26

WCFM Marketplace - Security Vulnerability (CVE-2026-14196)

The WCFM Marketplace WordPress plugin before 3.8.1 does not verify that a marketplace vendor owns a review before allowing it to be unapproved or deleted, allowing any vendor to modify or permanently delete reviews belonging to other vendors' stores.

PLUGIN WCFM Marketplace

CVE-2026-14196

MEDIUM CVSS 4.3 2026-08-19
Open Full Technical Breakdown
Threat Entry Updated 2026-07-13

WCFM Marketplace - Cross-Site Scripting (XSS) (CVE-2026-12126)

The WCFM Marketplace – Multivendor Marketplace for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Attachment 'post_title' in all versions up to, and including, 3.7.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Vendor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. An attacker can plant the payload by uploading a media attachment with a crafted title via the WordPress REST API (/wp-json/wp/v2/media), without ever invoking the…

PLUGIN WCFM Marketplace

CVE-2026-12126

MEDIUM CVSS 6.4 2026-07-11
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

WCFM Marketplace - Security Vulnerability (CVE-2026-1722)

The WCFM Marketplace – Multivendor Marketplace for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.7.0. This is due to the plugin not implementing authorization checks in the `wcfm-refund-requests-form` AJAX controller. This makes it possible for unauthenticated attackers to create arbitrary refund requests for any order ID and item ID, potentially leading to financial loss if automatic refund approval is enabled in the plugin settings.

PLUGIN WCFM Marketplace

CVE-2026-1722

MEDIUM CVSS 5.3 2026-02-10
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

WCFM Marketplace - Privilege Escalation (CVE-2025-3438)

The MStore API – Create Native Android & iOS Apps On The Cloud plugin for WordPress is vulnerable to limited privilege escalation in all versions up to, and including, 4.17.4. This is due to a lack of restriction of role when registering. This makes it possible for unauthenticated attackers to to register with the 'wcfm_vendor' role, which is a Store Vendor role in the WCFM Marketplace – Multivendor Marketplace for WooCommerce plugin for WordPress. The vulnerability can only be exploited if the WCFM Marketplace – Multivendor Marketplace for WooCommerce plugin…

PLUGIN WCFM Marketplace

CVE-2025-3438

MEDIUM CVSS 6.5 2025-05-02
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

Wcfm Marketplace - Cross-Site Scripting (XSS) (CVE-2023-4960)

The WCFM Marketplace plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'wcfm_stores' shortcode in versions up to, and including, 3.6.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

PLUGIN Wcfm Marketplace

CVE-2023-4960

MEDIUM CVSS 6.4 2024-01-11
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

Wcfm Marketplace - Privilege Escalation (CVE-2022-4935)

The WCFM Marketplace plugin for WordPress is vulnerable to unauthorized modification and access of data in versions up to, and including, 3.4.11 due to missing capability checks on various AJAX actions. This makes it possible for authenticated attackers, with minimal permissions such as subscribers, to perform a wide variety of actions such as modifying shipping method details, modifying products, deleting arbitrary posts, and privilege escalation (via the wp_ajax_wcfm_vendor_store_online AJAX action).

PLUGIN Wcfm Marketplace

CVE-2022-4935

HIGH CVSS 8.8 2023-04-05
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

Wcfm Marketplace - Cross-Site Request Forgery (CSRF) (CVE-2022-4936)

The WCFM Marketplace plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.4.11 due to missing nonce checks on various AJAX actions. This makes it possible for unauthenticated attackers to perform a wide variety of actions such as modifying shipping method details, modifying products, deleting arbitrary posts, and more, via a forged request granted they can trick a site's administrator into performing an action such as clicking on a link.

PLUGIN Wcfm Marketplace

CVE-2022-4936

MEDIUM CVSS 6.3 2023-04-05
Open Full Technical Breakdown

WordPress security that blocks attacks before they land.

sales@hackhalt.com

Product

Resources

Company

© Hack Halt Inc. All rights reserved.