WCFM Marketplace EUVD-2026-43158

Exploitation requires a valid WordPress user account with at least Vendor-level role within the WCFM Marketplace plugin - unauthenticated or subscriber-level exploitation is not possible per the CVSS PR:L metric. The attacker must be able to make authenticated calls to the /wp-json/wp/v2/media REST API endpoint, which is standard, enabled-by-default functionality for vendor accounts in any WCFM Marketplace installation. No special server-side configuration beyond a default installation of the plugin on WordPress with WooCommerce active is required; no non-default feature flag or configuration mode needs to be enabled. The XSS payload executes when a privileged user (administrator or above) loads the media management dashboard, meaning the attacker must wait for an administrator to perform a routine management task - the payload does not fire automatically on upload. Limiting factors: a vendor-level authenticated account is mandatory (not unauthenticated); a privileged user must subsequently navigate to the media dashboard interface for execution; and the attack is confined to the WordPress admin browsing context rather than the public-facing site.

The vendor-assigned CVSS 6.4 with vector AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N accurately captures the network-accessible, low-complexity nature of planting the payload, and the scope change (S:C) correctly models the cross-user impact where a vendor-level attacker compromises an administrator's session. The PR:L metric is appropriate: a vendor account is required and is not freely available without marketplace registration. The UI:N metric is debatable: standard NVD guidance for stored XSS typically applies UI:R because a victim user must navigate to the injected page, though from the attacker's own workflow no interaction is needed after upload; this does not materially change the base score but affects kill-chain modeling. No EPSS score was provided in the available data, so exploitation probability cannot be quantified. The absence of a CISA KEV listing and lack of known public exploit code suggest this is not under widespread active exploitation. Practical risk is moderate-to-elevated in real-world marketplace deployments: an untrusted vendor who gains an account can silently persist payloads that fire against every administrator visiting the media dashboard, potentially enabling session hijacking and full store compromise. The attack complexity is genuinely low once a vendor account exists, making this a higher-priority issue for stores where vendor self-registration is open.

A malicious vendor registered on a WooCommerce multi-vendor marketplace authenticates to the site and sends a crafted POST request to /wp-json/wp/v2/media, setting the media attachment title to a script payload designed to exfiltrate the administrator's session cookie to an attacker-controlled endpoint. The payload is stored unescaped in the WordPress database. When a store administrator later opens the media management dashboard for routine operations, the plugin's DataTables component fetches the media listing JSON containing the poisoned title and the browser immediately executes the injected script via innerHTML - potentially granting the attacker admin session access without any further action or social engineering. No public exploit code has been identified at time of analysis, but the REST API upload mechanism is standard, well-documented, and requires only a valid vendor authentication token.