EUVD-2026-43158
GHSA-392f-h24w-84fc
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Payload plants via REST API (AV:N/PR:L) but fires only when a victim admin loads the dashboard (UI:R); scope change applies as vendor-context payload executes in admin-context browser.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The WCFM Marketplace - Multivendor Marketplace for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Attachment 'post_title' in all versions up to, and including, 3.7.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Vendor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. An attacker can plant the payload by uploading a media attachment with a crafted title via the WordPress REST API (/wp-json/wp/v2/media), without ever invoking the AJAX endpoint themselves, as the unescaped title is later emitted inside DataTables JSON and inserted as innerHTML upon any privileged user loading the media dashboard.
AnalysisAI
Stored XSS in WCFM Marketplace - Multivendor Marketplace for WooCommerce (all versions ≤ 3.7.3) permits authenticated attackers holding a Vendor-level account to plant persistent JavaScript payloads inside WordPress media attachment titles, targeting any privileged user who subsequently loads the media management dashboard. The injection path is notable for its stealth: the attacker uploads a media file with a crafted post_title via the standard WordPress REST API (/wp-json/wp/v2/media), bypassing any AJAX-based access controls, because the unescaped title is later serialized into DataTables JSON and written directly to the DOM via innerHTML on the admin media interface. No public exploit code is identified and the vulnerability has no CISA KEV listing at time of analysis, but the low privilege barrier - any marketplace vendor account - meaningfully elevates real-world risk in multi-vendor deployments with untrusted sellers.
Technical ContextAI
The affected component is the WCFM Marketplace WordPress plugin by WC Lovers (CPE: cpe:2.3:a:wclovers:wcfm_marketplace_-_multivendor_marketplace_for_woocommerce), a WooCommerce extension enabling multi-vendor e-commerce storefronts. The root cause class is CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically a persistent/stored XSS variant. Source code references confirm the vulnerable logic exists across two specific files in both versions 3.7.2 and 3.7.3: wcfmmp-controller-media.php (at lines 58 and 120) and class-wcfmmp-media.php (at line 163). The plugin accepts the attachment post_title supplied through the WordPress REST API without sanitizing HTML special characters, stores the raw value in the WordPress database, and later emits it unescaped inside a DataTables JSON payload served to the media dashboard. Because the dashboard JavaScript uses innerHTML to render table cell content from that JSON, any script content in the title executes in the browsing context of whichever privileged user loads the interface - a classic server-side output-escaping failure compounded by unsafe client-side DOM insertion.
RemediationAI
A fix has been committed to the plugin's Subversion repository as changeset 3588629 (https://plugins.trac.wordpress.org/changeset?reponame=&old=3588629%40wc-multivendor-marketplace&new=3588629%40wc-multivendor-marketplace); however, the exact released plugin version incorporating this commit is not independently confirmed from the available data - site administrators should update to the latest available version from the WordPress plugin repository and verify it is numbered higher than 3.7.3. As an immediate compensating control, restrict vendor self-registration to require admin approval before granting Vendor-level role, which eliminates the ability for untrusted actors to obtain the required privilege level; the trade-off is added administrative overhead. If REST API write access to /wp-json/wp/v2/media can be restricted for vendor-role users via a custom capability filter or REST API authentication plugin, this removes the injection vector entirely, though it may break legitimate vendor media upload workflows. Deploying a WAF with XSS detection rules (e.g., Wordfence's firewall if already installed) provides additional layered defense but is not a substitute for patching. Refer to the full Wordfence advisory for further remediation guidance.
More in Wordpress Plugin
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
Remote code execution in the WP Query Console WordPress plugin (versions up to and including 1.0) by Ajit Bohra allows u
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today