# WCFM – Frontend Manager for WooCommerce <= 6.8.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Dashboard Notifications

- **ID:** WPSEC-2026-2348
- **Plugin:** WCFM – Frontend Manager for WooCommerce (`wc-frontend-manager`), https://wordpress.org/plugins/wc-frontend-manager/
- **Affected versions:** all versions before 6.8.2
- **Fixed in:** 6.8.2 (Update to 6.8.2 or later.)
- **Severity:** Medium 6.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N)
- **Weakness:** CWE-79
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-11-03)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/wc-frontend-manager
- **Fix released:** 2026-11-02
- **Published:** 2026-11-03
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2348/

## Description

The WCFM – Frontend Manager for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via dashboard notification messages in all versions up to, and including, 6.8.1, due to stored notification messages being passed through htmlspecialchars_decode() and output without sanitization in the notification popup and the messages list. This turns entity-encoded markup back into live HTML. Such markup can be planted through the inquiry form label (a store name or display name chosen with the submitted vendor ID) or through vendor messages. This makes it possible for authenticated attackers with subscriber-level access and above to inject arbitrary web scripts that execute when an administrator or vendor views their notifications.

## References

- https://wpsec.com/vuln/WPSEC-2026-2348/
- https://plugins.svn.wordpress.org/wc-frontend-manager/tags/6.8.2/
- https://wordpress.org/plugins/wc-frontend-manager/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2348/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.