Vulnerabilities / WCFM Marketplace
WCFM Marketplace vulnerabilities
Advisories WPSec published for WCFM Marketplace – Multivendor Marketplace for WooCommerce. Other sources may list more. Its attack surface: WCFM Marketplace on WPSec AttackSurface.
| Published | ID | Vulnerability | Severity | Fixed in |
|---|---|---|---|---|
| 2026-11-03 | WPSEC-2026-2375 | WCFM Marketplace <= 3.8.3 - Authenticated (Store Vendor+) Stored Cross-Site Scripting via Store Phone, Email, Support and Social Profile Fields | Medium 6.4 | 3.8.4 |
| 2026-11-03 | WPSEC-2026-2374 | WCFM Marketplace <= 3.8.3 - Authenticated (Store Vendor+) Stored Cross-Site Scripting via Store Video Banner | Medium 6.4 | 3.8.4 |
| 2026-11-03 | WPSEC-2026-2373 | WCFM Marketplace <= 3.8.3 - Authenticated (Store Vendor+) Privilege Escalation via WooCommerce and WordPress REST API | High 8.1 | 3.8.4 |
| 2026-11-03 | WPSEC-2026-2372 | WCFM Marketplace <= 3.8.3 - Unauthenticated Missing Authorization to Setup Wizard Access and Plugin Installation | Medium 5.3 | 3.8.4 |
| 2026-11-03 | WPSEC-2026-2371 | WCFM Marketplace <= 3.8.3 - Authenticated (Store Vendor+) Missing Authorization to Refund Request Approval and Rejection | Medium 6.5 | 3.8.4 |
License: CC BY 4.0