wclovers vulnerabilities

CVEs per yearBy the year they were published

1. 20239
2. 20242
3. 20252
4. 202610

Newest CVEs

• CVE-2026-18442

  WCFM Marketplace <= 3.8.2 - Unauthenticated SQL Injection via 'wcfmmp_user_location_lat' / 'wcfmmp_user_location_lng' Parameter

  wclovers · WCFM Marketplace – Multivendor Marketplace for WooCommerce

  High7.5
• CVE-2026-10041

  WCFM – Frontend Manager for WooCommerce <= 6.7.27 - Authenticated (Subscriber+) Missing Authorization to Arbitrary Vendor Data Manipulation via Multiple AJAX Handlers

  wclovers · WCFM – Frontend Manager for WooCommerce

  Medium4.3
• CVE-2026-12126

  WCFM Marketplace <= 3.7.3 - Authenticated (Vendor+) Stored Cross-Site Scripting via Attachment 'post_title'

  wclovers · WCFM Marketplace – Multivendor Marketplace for WooCommerce

  Medium6.4
• CVE-2026-12994

  WCFM – Frontend Manager for WooCommerce <= 6.7.27 - Missing Authorization to Unauthenticated Arbitrary Inquiry Reply Injection via wcfm-my-account-enquiry-manage Controller

  wclovers · WCFM – Frontend Manager for WooCommerce

  Medium5.3
• CVE-2026-3688

  WCFM - WooCommerce Multivendor Membership <= 2.11.10 - Insecure Direct Object Reference to Limited Privilege Escalation via User Role Overwrite

  wclovers · WCFM Membership – WooCommerce Memberships for Multivendor Marketplace

  High8.1
• CVE-2026-2554

  WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible <= 6.7.25 - Authenticated (Vendor+) Insecure Direct Object Reference to Arbitrary User Deletion

  wclovers · WCFM – Frontend Manager for WooCommerce

  High8.1
• CVE-2026-4896

  WCFM - WooCommerce Frontend Manager <= 6.7.25 - Insecure Direct Object References to Autenticated (Vendor+) Arbitrary Post/Product Manipulation

  wclovers · WCFM – Frontend Manager for WooCommerce

  High8.1
• CVE-2026-1722

  WCFM Marketplace <= 3.7.0 - Insecure Direct Object Reference to Unauthenticated Arbitrary Refund Request Creation

  wclovers · WCFM Marketplace – Multivendor Marketplace for WooCommerce

  Medium5.3
• CVE-2025-15147

  WCFM Membership – WooCommerce Memberships for Multivendor Marketplace <= 2.11.8 - Insecure Direct Object Reference to Update Membership Payment

  wclovers · WCFM Membership – WooCommerce Memberships for Multivendor Marketplace

  Medium4.3
• CVE-2026-0845

  WCFM - WooCommerce Frontend Manager <= 6.7.24 - Authenticated (Shop Manager+) Arbitrary Options Update

  wclovers · WCFM – Frontend Manager for WooCommerce

  High7.2