Vulnerabilities / WCFM – Frontend Manager for WooCommerce / WPSEC-2026-2350
WCFM – Frontend Manager for WooCommerce <= 6.8.1 - Reflected Cross-Site Scripting via Customer Details and Notice Manage Endpoints
Medium 6.1
CWE-79Fixed in 6.8.2
- ID
- WPSEC-2026-2350
- Plugin
- WCFM – Frontend Manager for WooCommerce (wc-frontend-manager)
- Affected
- all versions before 6.8.2
- Remediation
- Update to 6.8.2 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- Weakness
- CWE-79
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-11-03
- Attack surface
- WCFM – Frontend Manager for WooCommerce on WPSec AttackSurface
- Fix released
- Published
Description
The Frontend Manager for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'wcfm-customers-details' and 'wcfm-notice-manage' dashboard endpoints in all versions up to, and including, 6.8.1 due to insufficient input sanitization and output escaping of the endpoint value used in generated links. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a logged-in dashboard user into clicking a crafted link.
References
- https://wpsec.com/vuln/WPSEC-2026-2350/
- https://plugins.svn.wordpress.org/wc-frontend-manager/tags/6.8.2/
- https://wordpress.org/plugins/wc-frontend-manager/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS