CVE-2026-81286

Unauthenticated SQL Injection in WCFM Marketplace = 3.8.1 versions...

EUVD-2026-69934

Contributor Cross Site Scripting XSS in WCFM Marketplace = 3.8.2 versions...

CVE-2026-83562

CVE-2026-83562 is a Contributor Cross Site Scripting (XSS) vulnerability in the WordPress plugin WCFM Marketplace (versions ≤ 3.8.2 ). Discovered by Ananda Dhakal via Patchstack, the flaw requires an authenticated contributor-level user and user interaction to exploit, but results in a changed sc...

CVE-2026-83562 WordPress WCFM Marketplace plugin <= 3.8.2 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting XSS in WCFM Marketplace = 3.8.2 versions...

CVE-2026-81286 WordPress WCFM Marketplace plugin <= 3.8.1 - SQL Injection vulnerability

Unauthenticated SQL Injection in WCFM Marketplace = 3.8.1 versions...

EUVD-2026-69923

Unauthenticated SQL Injection in WCFM Marketplace = 3.8.1 versions...

CVE-2026-81286

CVE-2026-81286 is an unauthenticated SQL Injection in the WCFM Marketplace WordPress plugin, affecting versions 3.8.1 and earlier . The CNA (Patchstack) assigns a CVSS 3.1 score of 9.3 (CRITICAL) with a changed scope, indicating high confidentiality impact and low availability impact with no requ...

PT-2026-84684

Unauthenticated SQL Injection in WCFM Marketplace = 3.8.1 versions...

WordPress WCFM Marketplace plugin <= 3.8.1 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Ivaylo Atanassov in WordPress Plugin WCFM Marketplace versions = 3.8.1...

WordPress WCFM Marketplace plugin <= 3.8.2 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin WCFM Marketplace versions = 3.8.2...

CVE-2026-77701

The WCFM Marketplace WordPress plugin before 3.8.2 does not correctly verify that the person requesting a refund owns the order, allowing unauthenticated users to create refund requests against any guest checkout order on the site...

EUVD-2026-67571

The WCFM Marketplace WordPress plugin before 3.8.2 does not correctly verify that the person requesting a refund owns the order, allowing unauthenticated users to create refund requests against any guest checkout order on the site...

CVE-2026-77701

The WCFM Marketplace WordPress plugin before 3.8.2 fails to correctly verify that the requester of a refund owns the order. This allows unauthenticated users to create refund requests against any guest checkout order on the affected site. The root cause is an insufficient authorization check on t...

CVE-2026-77701 WCFM Marketplace < 3.8.2 - Unauthenticated Refund Request Creation on Guest Orders

The WCFM Marketplace WordPress plugin before 3.8.2 does not correctly verify that the person requesting a refund owns the order, allowing unauthenticated users to create refund requests against any guest checkout order on the site...

WordPress WCFM Marketplace plugin < 3.8.2 - Unauthenticated Refund Request Creation on Guest Orders vulnerability

Unauthenticated Refund Request Creation on Guest Orders vulnerability discovered by Shikhali Jamalzade in WordPress Plugin WCFM Marketplace versions 3.8.2...

CVE-2026-14196

The WCFM Marketplace WordPress plugin before 3.8.1 does not verify that a marketplace vendor owns a review before allowing it to be unapproved or deleted, allowing any vendor to modify or permanently delete reviews belonging to other vendors' stores...

CVE-2026-14196

The WCFM Marketplace WordPress plugin before 3.8.1 contains an IDOR flaw: it fails to verify review ownership, so any authenticated store vendor can unapprove or permanently delete reviews belonging to other vendors' stores. Exploitation requires low privileges (PR:L), network access, and no user...

CVE-2026-14196 WCFM Marketplace < 3.8.1 - Store Vendor+ Cross-Vendor Review Deletion and Status Update via IDOR

The WCFM Marketplace WordPress plugin before 3.8.1 does not verify that a marketplace vendor owns a review before allowing it to be unapproved or deleted, allowing any vendor to modify or permanently delete reviews belonging to other vendors' stores...

EUVD-2026-62262

The WCFM Marketplace WordPress plugin before 3.8.1 does not verify that a marketplace vendor owns a review before allowing it to be unapproved or deleted, allowing any vendor to modify or permanently delete reviews belonging to other vendors' stores...

CVE-2026-12126

The WCFM Marketplace – Multivendor Marketplace for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Attachment 'posttitle' in all versions up to, and including, 3.7.3 due to insufficient input sanitization and output escaping. This makes it possible for...