CVE-2021-24849

The wcfmajaxcontroller AJAX action of the WCFM Marketplace WordPress plugin before 3.4.12, available to unauthenticated and authenticated user, does not properly sanitise multiple parameters before using them in SQL statements, leading to SQL injections...

PT-2021-16330

Name of the Vulnerable Software and Affected Versions: WCFM Marketplace WordPress plugin versions prior to 3.4.12 Description: The issue concerns the wcfm ajax controller AJAX action, which is accessible to both unauthenticated and authenticated users. It fails to properly sanitise multiple...