WCFM Marketplace CVE-2026-83562

A WordPress account with at least Contributor role (or vendor-equivalent role in the WCFM Marketplace context) on the target site is required, as reflected by PR:L in the CVSS vector. The primary prerequisite limiting exploitation is obtaining this account - sites that restrict vendor or contributor registration to manually vetted users present a substantially higher barrier. Once a contributor account is obtained, victim interaction is required: a higher-privileged user (administrator, shop manager, or editor) must view, edit, or preview the maliciously crafted marketplace content (UI:R). No additional plugin configuration or non-default settings are indicated as prerequisites beyond a standard WCFM Marketplace deployment on WordPress with WooCommerce.

The CVSS 6.5 Medium score reflects a genuinely constrained exploitation profile: an attacker must hold a Contributor-level account (PR:L) and a higher-privileged victim must view the injected content (UI:R). The scope change metric (S:C) is the key risk amplifier - if an administrator views the payload, the script executes under their session authority, potentially enabling full WordPress site compromise through follow-on privileged actions such as creating rogue admin accounts or installing malicious plugins. Sites that permit open vendor or contributor self-registration face meaningfully higher exposure because the authentication barrier is trivially cleared. No public exploit code exists and the CVE does not appear in CISA KEV, placing current exploitation probability low; however, Patchstack's public disclosure of XSS details in popular WordPress plugins historically accelerates in-the-wild exploitation within weeks. The A:L metric in the provided CVSS vector is inconsistent with typical stored XSS impact, which does not credibly impair availability - this appears overstated.

An attacker registers a vendor or contributor account on a WooCommerce marketplace running WCFM Marketplace 3.8.2 - feasible on any site with open vendor registration - and injects a JavaScript payload into a product description or other marketplace content field that lacks proper output encoding. When a site administrator reviews or edits the content in the WordPress dashboard, the payload executes in their browser, exfiltrating their session cookie to an attacker-controlled endpoint or silently creating a new administrator account. No public proof-of-concept code has been identified at time of analysis.