322 matches found
PoC-CVE-2022-4939-
PoC-CVE-2022-4939 The attacker sends a specially crafted request to the wpajaxnoprivwcfmajaxcontroller AJAX action to modify the membership registration form and set the registration role to that of an administrator. Then, the plugin processes the request and modifies the membership registration...
WCFM WooCommerce Multivendor Marketplace < 3.4.12 - SQL Injection
The wcfmajaxcontroller AJAX action of the WCFM Marketplace WordPress plugin before 3.4.12, available to unauthenticated and authenticated user, does not properly sanitise multiple parameters before using them in SQL statements, leading to SQL injections. id: CVE-2021-24849 info: name: WCFM...
WCFM Membership <= 2.10.0 - Broken Access Control
The WCFM Membership plugin for WordPress is vulnerable to unauthorized modification and access of data in versions up to, and including, 2.10.0 due to missing capability checks true the AJAX actions: wcfm-memberships, wcfm-memberships-manage, and wcfm-memberships-settings. id: CVE-2022-4940 info:...
CVE-2026-103696
The Mobile builder WordPress plugin through 1.4.2 does not sanitise and escape a parameter before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacks on sites that also run the WCFM Delivery add-on...
CVE-2026-103696 Mobile Builder <= 1.4.2 - Unauthenticated SQLi via 'delivery_id' Parameter
The Mobile builder WordPress plugin through 1.4.2 does not sanitise and escape a parameter before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacks on sites that also run the WCFM Delivery add-on...
CVE-2026-103696
The Mobile builder WordPress plugin (versions
EUVD-2026-102687
The Mobile builder WordPress plugin through 1.4.2 does not sanitise and escape a parameter before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacks on sites that also run the WCFM Delivery add-on...
CVE-2026-103696 Mobile Builder <= 1.4.2 - Unauthenticated SQLi via 'delivery_id' Parameter
The Mobile builder WordPress plugin through 1.4.2 does not sanitise and escape a parameter before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacks on sites that also run the WCFM Delivery add-on...
PT-2026-115467
Name of the Vulnerable Software and Affected Versions Mobile builder WordPress plugin versions prior to 1.4.3 Description Unauthenticated users can perform SQL injection attacks on sites that use the WCFM Delivery add-on. This occurs because the plugin fails to sanitize and escape a parameter...
CVE-2026-103696: Improper Neutralization of Special Elements used in an SQL Command
The Mobile builder WordPress plugin through 1.4.2 does not sanitise and escape a parameter before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacks on sites that also run the WCFM Delivery add-on...
GHSA-WCFM-JP7M-RFFH
creationtimestamp| type| source ---|---|--- 2026-09-24 13:30:46+00:00| seen| https://bsky.app/profile/glitterbean.wehavecookies.social.ap.brid.gy/post/3mwbeh3cfyva2...
WordPress WCFM Marketplace – Multivendor Marketplace for WooCommerce plugin <= 3.8.2 - Unauthenticated SQL Injection vulnerability
Unauthenticated SQL Injection vulnerability discovered by Jonah Burgess CryptoCat in WordPress Plugin WCFM Marketplace versions = 3.8.2...
CVE-2026-18442
The WCFM Marketplace – Multivendor Marketplace for WooCommerce plugin for WordPress is vulnerable to generic SQL Injection via the 'wcfmmpuserlocationlng' parameter in all versions up to, and including, 3.8.2 due to insufficient escaping on the user supplied parameter and lack of sufficient...
EUVD-2026-82748
The WCFM Marketplace – Multivendor Marketplace for WooCommerce plugin for WordPress is vulnerable to generic SQL Injection via the 'wcfmmpuserlocationlng' parameter in all versions up to, and including, 3.8.2 due to insufficient escaping on the user supplied parameter and lack of sufficient...
CVE-2026-18442 WCFM Marketplace <= 3.8.2 - Unauthenticated SQL Injection via 'wcfmmp_user_location_lat' / 'wcfmmp_user_location_lng' Parameter
The WCFM Marketplace – Multivendor Marketplace for WooCommerce plugin for WordPress is vulnerable to generic SQL Injection via the 'wcfmmpuserlocationlng' parameter in all versions up to, and including, 3.8.2 due to insufficient escaping on the user supplied parameter and lack of sufficient...
CVE-2026-18442
WCFM Marketplace – Multivendor Marketplace for WooCommerce (WordPress plugin) is vulnerable to unauthenticated SQL injection via the 'wcfmmp_user_location_lng' and 'wcfmmp_user_location_lat' parameters in all versions up to, and including, 3.8.2 . The root cause is insufficient escaping on user-s...
CVE-2026-18442 WCFM Marketplace <= 3.8.2 - Unauthenticated SQL Injection via 'wcfmmp_user_location_lat' / 'wcfmmp_user_location_lng' Parameter
The WCFM Marketplace – Multivendor Marketplace for WooCommerce plugin for WordPress is vulnerable to generic SQL Injection via the 'wcfmmpuserlocationlng' parameter in all versions up to, and including, 3.8.2 due to insufficient escaping on the user supplied parameter and lack of sufficient...
CVE-2026-18442: Improper Neutralization of Special Elements used in an SQL Command
The WCFM Marketplace – Multivendor Marketplace for WooCommerce plugin for WordPress is vulnerable to generic SQL Injection via the 'wcfmmpuserlocationlng' parameter in all versions up to, and including, 3.8.2 due to insufficient escaping on the user supplied parameter and lack of sufficient...
PT-2026-95291
Name of the Vulnerable Software and Affected Versions WCFM Marketplace versions prior to 3.8.2 Description The WCFM Marketplace plugin for WordPress is subject to SQL Injection, a technique where malicious SQL statements are inserted into entry fields for execution. This occurs because the...