CVE-2026-84756

Subscriber Privilege Escalation in WCFM Membership = 2.11.11 versions...

CVE-2026-84756 WordPress WCFM Membership plugin <= 2.11.11 - Privilege Escalation vulnerability

Subscriber Privilege Escalation in WCFM Membership = 2.11.11 versions...

CVE-2026-84756

CVE-2026-84756 is a privilege escalation vulnerability affecting the WCFM Membership WordPress plugin in versions 2.11.11 and below . The flaw allows a user with Subscriber privileges to escalate their access level. The vulnerability is rated HIGH (CVSS 3.1: 7.1) , with a network attack vector, l...

EUVD-2026-70586

Subscriber Privilege Escalation in WCFM Membership = 2.11.11 versions...

CVE-2026-84756 WordPress WCFM Membership plugin <= 2.11.11 - Privilege Escalation vulnerability

Subscriber Privilege Escalation in WCFM Membership = 2.11.11 versions...

PT-2026-85099

Subscriber Privilege Escalation in WCFM Membership = 2.11.11 versions...

CVE-2026-84756: Incorrect Privilege Assignment

Subscriber Privilege Escalation in WCFM Membership = 2.11.11 versions...

CVE-2026-83562

Contributor Cross Site Scripting XSS in WCFM Marketplace = 3.8.2 versions...

CVE-2026-81286

Unauthenticated SQL Injection in WCFM Marketplace = 3.8.1 versions...

WordPress WCFM Membership plugin <= 2.11.11 - Privilege Escalation vulnerability

Privilege Escalation vulnerability discovered by yagamimoon in WordPress Plugin WCFM Membership versions = 2.11.11...

CVE-2026-83562

CVE-2026-83562 is a Contributor Cross Site Scripting (XSS) vulnerability in the WordPress plugin WCFM Marketplace (versions ≤ 3.8.2 ). Discovered by Ananda Dhakal via Patchstack, the flaw requires an authenticated contributor-level user and user interaction to exploit, but results in a changed sc...

EUVD-2026-69934

Contributor Cross Site Scripting XSS in WCFM Marketplace = 3.8.2 versions...

CVE-2026-83562 WordPress WCFM Marketplace plugin <= 3.8.2 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting XSS in WCFM Marketplace = 3.8.2 versions...

CVE-2026-83562 WordPress WCFM Marketplace plugin <= 3.8.2 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting XSS in WCFM Marketplace = 3.8.2 versions...

EUVD-2026-69923

Unauthenticated SQL Injection in WCFM Marketplace = 3.8.1 versions...

CVE-2026-81286

CVE-2026-81286 is an unauthenticated SQL Injection in the WCFM Marketplace WordPress plugin, affecting versions 3.8.1 and earlier . The CNA (Patchstack) assigns a CVSS 3.1 score of 9.3 (CRITICAL) with a changed scope, indicating high confidentiality impact and low availability impact with no requ...

CVE-2026-81286 WordPress WCFM Marketplace plugin <= 3.8.1 - SQL Injection vulnerability

Unauthenticated SQL Injection in WCFM Marketplace = 3.8.1 versions...

CVE-2026-81286 WordPress WCFM Marketplace plugin <= 3.8.1 - SQL Injection vulnerability

Unauthenticated SQL Injection in WCFM Marketplace = 3.8.1 versions...

PT-2026-84695

Contributor Cross Site Scripting XSS in WCFM Marketplace = 3.8.2 versions...

CVE-2026-83562: Improper Neutralization of Input During Web Page Generation

Contributor Cross Site Scripting XSS in WCFM Marketplace = 3.8.2 versions...