EUVD-2025-209485
SQL Injection (CWE-89)
GHSA-m7v3-c773-h4rx
7.6
CVSS 3.1 · NVD
Share
Severity by source
NVD
PRIMARY
7.6
HIGH
AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L
Attack Vector
Network
Attack Complexity
Low
Privileges Required
High
User Interaction
None
Scope
Changed
Confidentiality
High
Integrity
None
Availability
Low
Lifecycle Timeline
2
EUVD ID Assigned
Apr 15, 2026 - 16:45 euvd
EUVD-2025-209485
CVE Published
Apr 15, 2026 - 16:21 nvd
HIGH 7.6
DescriptionCVE.org
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WC Lovers WCFM Marketplace allows SQL Injection.This issue affects WCFM Marketplace: from n/a through 3.7.1.
Analysis
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WC Lovers WCFM Marketplace allows SQL Injection.This issue affects WCFM Marketplace: from n/a through 3.7.1.
More in Wcfm Marketplace
View all
CVE-2022-4935
HIGH
8.8
Apr 05
The WCFM Marketplace plugin for WordPress is vulnerable to unauthorized modification and access of data in versions up t
CVE-2022-4936
MEDIUM
6.3
Apr 05
The WCFM Marketplace plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including,
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today
Destination URL
POC code from unknown sources may be malicious, contain backdoors, or be fake.
Always review and test exploit code in a safe, isolated environment (VM/sandbox).
Verify the source reputation and cross-reference with known databases (Exploit-DB, GitHub Security).