Skip to content

Wclovers vulnerabilities

Products

Newest

wc lovers woocommerce multivendor marketplace – rest api WordPress WooCommerce Multivendor Marketplace – REST API plugin <= 1.6.3 - Broken Access Control vulnerability CVE-2026-39794 7.5 HighOctober 6, 2026
wclovers wcfm marketplace – multivendor marketplace for woocommerce WCFM Marketplace <= 3.8.2 - Unauthenticated SQL Injection via 'wcfmmp_user_location_lat' / 'wcfmmp_user_location_lng' Parameter CVE-2026-18442 7.5 HighSeptember 18, 2026
wclovers wcfm – frontend manager for woocommerce WCFM – Frontend Manager for WooCommerce <= 6.7.27 - Authenticated (Subscriber+) Missing Authorization to Arbitrary Vendor Data Manipulation via Multiple AJAX Handlers CVE-2026-10041 4.3 MediumJuly 11, 2026
wclovers wcfm – frontend manager for woocommerce WCFM – Frontend Manager for WooCommerce <= 6.7.27 - Missing Authorization to Unauthenticated Arbitrary Inquiry Reply Injection via wcfm-my-account-enquiry-manage Controller CVE-2026-12994 5.3 MediumJuly 11, 2026
wclovers wcfm marketplace – multivendor marketplace for woocommerce WCFM Marketplace <= 3.7.3 - Authenticated (Vendor+) Stored Cross-Site Scripting via Attachment 'post_title' CVE-2026-12126 6.4 MediumJuly 11, 2026
wclovers wcfm membership – woocommerce memberships for multivendor marketplace WCFM - WooCommerce Multivendor Membership <= 2.11.10 - Insecure Direct Object Reference to Limited Privilege Escalation via User Role Overwrite CVE-2026-3688 8.1 HighJuly 8, 2026
wclovers wcfm – frontend manager for woocommerce WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible <= 6.7.25 - Authenticated (Vendor+) Insecure Direct Object Reference to Arbitrary User Deletion CVE-2026-2554 8.1 HighMay 2, 2026
wclovers wcfm – frontend manager for woocommerce WCFM - WooCommerce Frontend Manager <= 6.7.25 - Insecure Direct Object References to Autenticated (Vendor+) Arbitrary Post/Product Manipulation CVE-2026-4896 8.1 HighApril 4, 2026
wclovers wcfm marketplace – multivendor marketplace for woocommerce WCFM Marketplace <= 3.7.0 - Insecure Direct Object Reference to Unauthenticated Arbitrary Refund Request Creation CVE-2026-1722 5.3 MediumFebruary 10, 2026
wclovers wcfm membership – woocommerce memberships for multivendor marketplace WCFM Membership – WooCommerce Memberships for Multivendor Marketplace <= 2.11.8 - Insecure Direct Object Reference to Update Membership Payment CVE-2025-15147 4.3 MediumFebruary 9, 2026
wclovers wcfm – frontend manager for woocommerce WCFM - WooCommerce Frontend Manager <= 6.7.24 - Authenticated (Shop Manager+) Arbitrary Options Update CVE-2026-0845 7.2 HighFebruary 9, 2026
wc lovers wcfm – frontend manager for woocommerce WordPress WCFM – Frontend Manager for WooCommerce plugin <= 6.7.24 - Broken Access Control vulnerability CVE-2025-54004 2.7 LowDecember 16, 2025
wclovers frontend manager for woocommerce along with bookings subscription listings compatible, wcfm – frontend manager for woocommerce +1 more WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible <= 6.7.16 - Missing Authorization to Unauthenticated Plugin Settings Modification CVE-2025-3780 6.5 MediumJuly 8, 2025
wclovers wcfm – multivendor marketplace rest api for woocommerce WooCommerce Multivendor Marketplace – REST API <= 1.6.2 - Authenticated (Subscriber+) SQL Injection CVE-2025-1311 6.5 MediumMarch 22, 2025
wclovers frontend manager for woocommerce along with bookings subscription listings compatible, wcfm – frontend manager for woocommerce +1 more WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible <= 6.7.12 - Insecure Direct Object Reference to Account Takeover/Privilege Escalation CVE-2024-8290 8.8 HighSeptember 25, 2024
wc lovers wcfm marketplace WordPress WCFM Marketplace <= 3.6.11 - Reflected Cross Site Scripting (XSS) vulnerability CVE-2024-44009 7.1 HighSeptember 17, 2024
wc lovers wcfm – frontend manager for woocommerce WordPress WCFM plugin <= 6.7.8 - Cross Site Scripting (XSS) vulnerability CVE-2024-29929 5.9 MediumMarch 27, 2024
wclovers wcfm marketplace, wcfm marketplace – multivendor marketplace for woocommerce +1 more WCFM Marketplace <= 3.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode CVE-2023-4960 6.4 MediumJanuary 11, 2024
wclovers woocommerce multivendor marketplace, wcfm – multivendor marketplace rest api for woocommerce +1 more WooCommerce Multivendor Marketplace – REST API <= 1.5.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Order/Order Note Disclosure, Order Note Addition via REST API CVE-2023-2275 4.3 MediumJune 9, 2023
wclovers wcfm membership – woocommerce memberships for multivendor marketplace, wcfm membership +1 more WCFM Membership – WooCommerce Memberships for Multivendor Marketplace <= 2.10.7 - Unauthenticated Insecure Direct Object Reference to Arbitrary User Password Change CVE-2023-2276 9.8 CriticalMay 20, 2023
wclovers wcfm membership, wcfm membership – woocommerce memberships for multivendor marketplace +1 more WCFM Membership <= 2.9.10 - Cross-Site Request Forgery CVE-2022-4941 6.3 MediumApril 5, 2023
wclovers wcfm membership, wcfm membership – woocommerce memberships for multivendor marketplace +1 more WCFM Membership <= 2.10.0 - Missing Authorization CVE-2022-4940 7.3 HighApril 5, 2023
wclovers wcfm membership, wcfm membership – woocommerce memberships for multivendor marketplace +1 more WCFM Membership <= 2.10.0 - Unauthenticated Privilege Escalation CVE-2022-4939 Public exploit 9.8 CriticalApril 5, 2023
wclovers frontend manager for woocommerce along with bookings subscription listings compatible, wcfm – frontend manager for woocommerce +1 more WCFM Frontend Manager <= 6.5.13 - Cross-Site Request Forgery CVE-2022-4938 6.3 MediumApril 5, 2023
wclovers frontend manager for woocommerce along with bookings subscription listings compatible, wcfm – frontend manager for woocommerce along with bookings subscription listings compatible +1 more The WCFM Frontend Manager plugin for WordPress is vulnerable to unauthorized modification and... CVE-2022-4937 6.3 MediumApril 5, 2023
wclovers wcfm marketplace, wcfm marketplace – multivendor marketplace for woocommerce +1 more WCFM Marketplace <= 3.4.12 - Cross-Site Request Forgery CVE-2022-4936 6.3 MediumApril 5, 2023
wclovers wcfm marketplace, wcfm marketplace – multivendor marketplace for woocommerce +1 more WCFM Marketplace <= 3.4.11 - Missing Authorization CVE-2022-4935 8.8 HighApril 5, 2023
unknown wcfm marketplace – best multivendor marketplace for woocommerce, wclovers frontend manager for woocommerce along with bookings subscription listings compatible +1 more WCFM - WooCommerce Multivendor Marketplace < 3.4.12 - Unauthenticated SQL Injection CVE-2021-24849 9.8 CriticalDecember 21, 2021
unknown wcfm – frontend manager for woocommerce along with bookings subscription listings compatible, wclovers frontend manager for woocommerce along with bookings subscription listings compatible +1 more WCFM - Frontend Manager for WooCommerce < 6.5.12 - Customer/Subscriber+ SQL Injection CVE-2021-24835 8.8 HighNovember 8, 2021