WCFM – Frontend Manager for WooCommerce <= 6.8.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Dashboard Notifications
- ID
- WPSEC-2026-2348
- Plugin
- WCFM – Frontend Manager for WooCommerce (wc-frontend-manager)
- Affected
- all versions before 6.8.2
- Remediation
- Update to 6.8.2 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
- Weakness
- CWE-79
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-11-03
- Attack surface
- WCFM – Frontend Manager for WooCommerce on WPSec AttackSurface
- Fix released
- Published
Description
The WCFM – Frontend Manager for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via dashboard notification messages in all versions up to, and including, 6.8.1, due to stored notification messages being passed through htmlspecialchars_decode() and output without sanitization in the notification popup and the messages list. This turns entity-encoded markup back into live HTML. Such markup can be planted through the inquiry form label (a store name or display name chosen with the submitted vendor ID) or through vendor messages. This makes it possible for authenticated attackers with subscriber-level access and above to inject arbitrary web scripts that execute when an administrator or vendor views their notifications.
References
- https://wpsec.com/vuln/WPSEC-2026-2348/
- https://plugins.svn.wordpress.org/wc-frontend-manager/tags/6.8.2/
- https://wordpress.org/plugins/wc-frontend-manager/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS