CVE-2026-61987

The WC Lovers WCFM – Frontend Manager for WooCommerce plugin (specifically the wc-frontend-manager component) is vulnerable to a Stored Cross-site Scripting (XSS) vulnerability due to improper neutralization of input during web page generation. This issue affects versions from the initial release...

CVE-2026-61987 WordPress WCFM – Frontend Manager for WooCommerce plugin <= 6.8.1 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WC Lovers WCFM – Frontend Manager for WooCommerce wc-frontend-manager allows Stored XSS.This issue affects WCFM – Frontend Manager for WooCommerce: from n/a through 6.8.1...

WordPress Plugin: wc-frontend-manager-ultimate: CVE-2026-22335: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Subscriber SQL Injection in WooCommerce Frontend Manager – Ultimate 6.7.7 versions...