WCFM Marketplace – Multivendor Marketplace for WooCommerce

Уязвимости

• CVE-2026-81286без авторизации≤ 3.8.1

  WordPress WCFM Marketplace plugin <= 3.8.1 - SQL Injection vulnerability

  Критич. 9.3

• CVE-2022-4936без авторизации · нужен клик≤ 3.4.12

  WCFM Marketplace <= 3.4.12 - Cross-Site Request Forgery

  Высокий 8.8

• CVE-2022-4935подписчик+≤ 3.4.11

  WCFM Marketplace <= 3.4.11 - Missing Authorization

  Высокий 8.8

• CVE-2025-63029высокие права≤ 3.7.1

  WordPress WCFM Marketplace plugin <= 3.7.1 - SQL Injection vulnerability

  Высокий 7.6

• CVE-2026-18442без авторизации≤ 3.8.2

  WCFM Marketplace <= 3.8.2 - Unauthenticated SQL Injection via 'wcfmmp_user_location_lat' / 'wcfmmp_user_location_lng' Parameter

  Высокий 7.5

• CVE-2026-83562участник+≤ 3.8.2

  WordPress WCFM Marketplace plugin <= 3.8.2 - Cross Site Scripting (XSS) vulnerability

  Средний 6.5

• CVE-2026-12126нужен вход≤ 3.7.3

  WCFM Marketplace <= 3.7.3 - Authenticated (Vendor+) Stored Cross-Site Scripting via Attachment 'post_title'

  Средний 6.4

• CVE-2024-44009без авторизации · нужен клик≤ 3.6.11

  WordPress WCFM Marketplace <= 3.6.11 - Reflected Cross Site Scripting (XSS) vulnerability

  Средний 6.1

• CVE-2023-4960участник+≤ 3.6.2

  WCFM Marketplace <= 3.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

  Средний 5.4

• CVE-2026-1722без авторизации≤ 3.7.0

  WCFM Marketplace <= 3.7.0 - Insecure Direct Object Reference to Unauthenticated Arbitrary Refund Request Creation

  Средний 5.3

• CVE-2025-64631высокие права≤ 3.7.1

  WordPress WCFM Marketplace plugin <= 3.7.1 - Broken Access Control vulnerability

  Средний 4.9