{
 "id": "WPSEC-2026-2350",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2350/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2350/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2350/index.md",
 "title": "WCFM – Frontend Manager for WooCommerce <= 6.8.1 - Reflected Cross-Site Scripting via Customer Details and Notice Manage Endpoints",
 "description": "The Frontend Manager for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'wcfm-customers-details' and 'wcfm-notice-manage' dashboard endpoints in all versions up to, and including, 6.8.1 due to insufficient input sanitization and output escaping of the endpoint value used in generated links. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a logged-in dashboard user into clicking a crafted link.",
 "plugin": {
  "slug": "wc-frontend-manager",
  "name": "WCFM – Frontend Manager for WooCommerce",
  "full_name": "WCFM – Frontend Manager for WooCommerce",
  "wordpress_org": "https://wordpress.org/plugins/wc-frontend-manager/",
  "advisories_url": "https://wpsec.com/vuln/plugin/wc-frontend-manager/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/wc-frontend-manager"
 },
 "type": "XSS",
 "cwe": [
  "CWE-79"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 6.1,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "6.8.2",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 6.8.2"
  ]
 },
 "introduced_in": null,
 "fixed_in": "6.8.2",
 "remediation": "Update to 6.8.2 or later.",
 "fix_released": "2026-11-02T08:35:51+00:00",
 "published": "2026-11-03T14:48:33+00:00",
 "updated": "2026-11-03T13:39:48.249453+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2350/",
  "https://plugins.svn.wordpress.org/wc-frontend-manager/tags/6.8.2/",
  "https://wordpress.org/plugins/wc-frontend-manager/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/wc-frontend-manager",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-11-03"
 }
}