128 matches found
CVE-2024-6244
š pz-frontend-manager = 1.0.5 - CSRF Profile Picture Exploit š ļø Description This script exploits a CSRF vulnerability in the WordPress plugin pz-frontend-manager versions = 1.0.5 to change the profile picture of a logged-in user without their consent. š“ CVE-2024-6244 The plugin lacks proper CSRF...
CVE-2026-61987
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WC Lovers WCFM ā Frontend Manager for WooCommerce wc-frontend-manager allows Stored XSS.This issue affects WCFM ā Frontend Manager for WooCommerce: from n/a through 6.8.1...
CVE-2026-61987
The WC Lovers WCFM ā Frontend Manager for WooCommerce plugin (specifically the wc-frontend-manager component) is vulnerable to a Stored Cross-site Scripting (XSS) vulnerability due to improper neutralization of input during web page generation. This issue affects versions from the initial release...
EUVD-2026-119617
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WC Lovers WCFM ā Frontend Manager for WooCommerce wc-frontend-manager allows Stored XSS.This issue affects WCFM ā Frontend Manager for WooCommerce: from n/a through 6.8.1...
CVE-2026-61987 WordPress WCFM ā Frontend Manager for WooCommerce plugin <= 6.8.1 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WC Lovers WCFM ā Frontend Manager for WooCommerce wc-frontend-manager allows Stored XSS.This issue affects WCFM ā Frontend Manager for WooCommerce: from n/a through 6.8.1...
PT-2026-140023
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WC Lovers WCFM ā Frontend Manager for WooCommerce wc-frontend-manager allows Stored XSS.This issue affects WCFM ā Frontend Manager for WooCommerce: from n/a through 6.8.1...
CVE-2026-61987: WC Lovers WCFM ā Frontend Manager for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WC Lovers WCFM āā¦
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WC Lovers WCFM ā Frontend Manager for WooCommerce wc-frontend-manager allows Stored XSS.This issue affects WCFM ā Frontend Manager for WooCommerce: from n/a through 6.8.1...
WordPress WCFM ā Frontend Manager for WooCommerce plugin <= 6.8.1 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by Intrudify in WordPress Plugin WCFM ā Frontend Manager for WooCommerce versions = 6.8.1...
CVE-2026-10041 WCFM ā Frontend Manager for WooCommerce <= 6.7.27 - Authenticated (Subscriber+) Missing Authorization to Arbitrary Vendor Data Manipulation via Multiple AJAX Handlers
The WCFM ā Frontend Manager for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.7.27 via the wcfmproductarchive due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with...
EUVD-2026-43156
The WCFM ā Frontend Manager for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.7.27. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attacker...
CVE-2026-12994
Technical details are not publicly available in the provided documents. The description summarizes the vulnerability but lacks concrete affected versions, components, and remediation specifics beyond general impact. Monitor for updates.
PT-2026-57406
The WCFM ā Frontend Manager for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.7.27 via the wcfm product archive due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with...
CVE-2026-12994: Missing Authorization
The WCFM ā Frontend Manager for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.7.27. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attacker...
PT-2026-57414
The WCFM ā Frontend Manager for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.7.27. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attacker...
CVE-2026-10041: Authorization Bypass Through User-Controlled Key
The WCFM ā Frontend Manager for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.7.27 via the wcfmproductarchive due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with...
WordPress WCFM ā Frontend Manager for WooCommerce plugin <= 6.7.27 - Missing Authorization to Unauthenticated Arbitrary Inquiry Reply Injection vulnerability
Missing Authorization to Unauthenticated Arbitrary Inquiry Reply Injection vulnerability discovered by Niv Kochan in WordPress Plugin WCFM ā Frontend Manager for WooCommerce versions = 6.7.27...
WordPress WCFM ā Frontend Manager for WooCommerce plugin <= 6.7.27 - Authenticated (Subscriber+) Missing Authorization to Arbitrary Vendor Data Manipulation vulnerability
Authenticated Subscriber+ Missing Authorization to Arbitrary Vendor Data Manipulation vulnerability discovered by mrholmes, papadope in WordPress Plugin WCFM ā Frontend Manager for WooCommerce versions = 6.7.27...
EUVD-2026-37657
Subscriber SQL Injection in WooCommerce Frontend Manager ā Ultimate 6.7.7 versions...