WCFM Marketplace EUVD-2026-119007

Exploitation requires (1) a valid low-privilege authenticated account on the WCFM Marketplace installation (PR:L) able to reach a field whose input is stored and later rendered, and (2) a victim who subsequently views the page where the stored payload renders (UI:R). The available sources do not name the exact vulnerable feature, form, or parameter, so the precise injection point is not described. Limiting factors that reduce real-world risk: authentication is mandatory (not anonymous), victim interaction is required for the script to execute, and impact is bounded to Low on confidentiality, integrity, and availability. The affected versions run from an unspecified lower bound through 3.8.3.

This is a moderate-severity Stored Cross-Site Scripting (CWE-79) issue in the WCFM Marketplace WordPress plugin, rated CVSS 6.5 with vector AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L. The network vector and low attack complexity make the injection step easy, but exploitation is gated by two meaningful limiters: the attacker must already hold a low-privilege authenticated account (PR:L) and a victim must interact with the poisoned page (UI:R) for the payload to fire. The changed scope (S:C) reflects that script injected in the plugin context can execute in a victim's browser session, which is why confidentiality, integrity, and availability each carry Low impact. On the decision signals: the vuln.today priority is 'this_month' (not act_now or emergency), there is no CISA KEV listing, and no EPSS probability was supplied - the combination points to a real but non-urgent, patch-in-routine-cycle issue rather than a widespread active-exploitation priority. The only reference is a Patchstack database entry, which is an advisory record, not verified working exploit code. No conflicting signals were observed between the CVSS vector and the description; both are consistent with authenticated stored XSS requiring victim interaction. Missing data: no EPSS score, no independent fixed-version confirmation beyond the affected range.

A low-privilege authenticated user of the marketplace (for example a vendor or registered customer) submits input into a WCFM Marketplace field that is stored and later rendered without proper neutralization, planting a malicious script. When an administrator or another user subsequently views the page containing that stored data, the script executes in their browser session, potentially enabling session/action abuse in the victim's context. No confirmed working exploit code is published; the only reference is a Patchstack advisory entry.