{
 "id": "WPSEC-2026-2348",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2348/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2348/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2348/index.md",
 "title": "WCFM – Frontend Manager for WooCommerce <= 6.8.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Dashboard Notifications",
 "description": "The WCFM – Frontend Manager for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via dashboard notification messages in all versions up to, and including, 6.8.1, due to stored notification messages being passed through htmlspecialchars_decode() and output without sanitization in the notification popup and the messages list. This turns entity-encoded markup back into live HTML. Such markup can be planted through the inquiry form label (a store name or display name chosen with the submitted vendor ID) or through vendor messages. This makes it possible for authenticated attackers with subscriber-level access and above to inject arbitrary web scripts that execute when an administrator or vendor views their notifications.",
 "plugin": {
  "slug": "wc-frontend-manager",
  "name": "WCFM – Frontend Manager for WooCommerce",
  "full_name": "WCFM – Frontend Manager for WooCommerce",
  "wordpress_org": "https://wordpress.org/plugins/wc-frontend-manager/",
  "advisories_url": "https://wpsec.com/vuln/plugin/wc-frontend-manager/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/wc-frontend-manager"
 },
 "type": "XSS",
 "cwe": [
  "CWE-79"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 6.4,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "6.8.2",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 6.8.2"
  ]
 },
 "introduced_in": null,
 "fixed_in": "6.8.2",
 "remediation": "Update to 6.8.2 or later.",
 "fix_released": "2026-11-02T08:35:51+00:00",
 "published": "2026-11-03T14:48:33+00:00",
 "updated": "2026-11-03T13:39:48.249453+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2348/",
  "https://plugins.svn.wordpress.org/wc-frontend-manager/tags/6.8.2/",
  "https://wordpress.org/plugins/wc-frontend-manager/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/wc-frontend-manager",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-11-03"
 }
}