EUVD-2026-69934
GHSA-44q9-95m2-m9qg
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
Stored XSS with scope change enables session theft (C:L) and unauthorized privileged actions (I:L), but no plausible availability impact, so A:N rather than the reported A:L.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
Lifecycle Timeline
1DescriptionCVE.org
Contributor Cross Site Scripting (XSS) in WCFM Marketplace <= 3.8.2 versions.
AnalysisAI
Stored cross-site scripting in WCFM Marketplace (WordPress WooCommerce multivendor plugin) through version 3.8.2 allows authenticated contributors to inject persistent malicious JavaScript into marketplace content. When a higher-privileged user such as a site administrator or shop manager views the injected content, the payload executes within their browser session - enabling session hijacking, credential theft, or administrative actions performed on the attacker's behalf via the scope change. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | A WordPress account with at least Contributor role (or vendor-equivalent role in the WCFM Marketplace context) on the target site is required, as reflected by PR:L in the CVSS vector. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 6.5 Medium score reflects a genuinely constrained exploitation profile: an attacker must hold a Contributor-level account (PR:L) and a higher-privileged victim must view the injected content (UI:R). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Update WCFM Marketplace to the first version released after 3.8.2 via the WordPress plugin repository or the plugin vendor's update channel; consult the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/wc-multivendor-marketplace/vulnerability/wordpress-wcfm-marketplace-plugin-3-8-2-cross-site-scripting-xss-vulnerability for the confirmed fix version, which is not specified in currently available data. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Wcfm Marketplace
View allSQL injection in the WCFM Marketplace WordPress plugin (versions 3.8.1 and earlier) lets remote unauthenticated attacker
Missing authorization in WCFM Marketplace WordPress plugin before 3.8.2 allows unauthenticated users to submit refund re
The WCFM Marketplace plugin for WordPress is vulnerable to unauthorized modification and access of data in versions up t
SQL injection in the WCFM Marketplace plugin for WordPress allows authenticated high-privilege users (e.g., administrato
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WC Lovers WCFM Mar
The WCFM Marketplace plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'wcfm_stores' shortcode in ve
The WCFM Marketplace plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including,
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today