WCFM Marketplace – Multivendor Marketplace for WooCommerce

Güvenlik açıkları

• CVE-2026-81286

  WordPress WCFM Marketplace plugin <= 3.8.1 - SQL Injection vulnerability

  Kritik 9.3

• CVE-2022-4936

  WCFM Marketplace <= 3.4.12 - Cross-Site Request Forgery

  Yüksek 8.8

• CVE-2022-4935

  WCFM Marketplace <= 3.4.11 - Missing Authorization

  Yüksek 8.8

• CVE-2025-63029

  WordPress WCFM Marketplace plugin <= 3.7.1 - SQL Injection vulnerability

  Yüksek 7.6

• CVE-2026-18442

  WCFM Marketplace <= 3.8.2 - Unauthenticated SQL Injection via 'wcfmmp_user_location_lat' / 'wcfmmp_user_location_lng' Parameter

  Yüksek 7.5

• CVE-2026-83562

  WordPress WCFM Marketplace plugin <= 3.8.2 - Cross Site Scripting (XSS) vulnerability

  Orta 6.5

• CVE-2026-12126

  WCFM Marketplace <= 3.7.3 - Authenticated (Vendor+) Stored Cross-Site Scripting via Attachment 'post_title'

  Orta 6.4

• CVE-2024-44009

  WordPress WCFM Marketplace <= 3.6.11 - Reflected Cross Site Scripting (XSS) vulnerability

  Orta 6.1

• CVE-2023-4960

  WCFM Marketplace <= 3.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

  Orta 5.4

• CVE-2026-1722

  WCFM Marketplace <= 3.7.0 - Insecure Direct Object Reference to Unauthenticated Arbitrary Refund Request Creation

  Orta 5.3

• CVE-2025-64631

  WordPress WCFM Marketplace plugin <= 3.7.1 - Broken Access Control vulnerability

  Orta 4.9