Wcfm Marketplace
Monthly
Stored cross-site scripting in WCFM Marketplace (WordPress WooCommerce multivendor plugin) through version 3.8.2 allows authenticated contributors to inject persistent malicious JavaScript into marketplace content. When a higher-privileged user such as a site administrator or shop manager views the injected content, the payload executes within their browser session - enabling session hijacking, credential theft, or administrative actions performed on the attacker's behalf via the scope change. Reported by Patchstack; no public exploit code or active exploitation has been identified.
SQL injection in the WCFM Marketplace WordPress plugin (versions 3.8.1 and earlier) lets remote unauthenticated attackers inject arbitrary SQL into backend database queries. Per the CVSS vector this is exploitable over the network without privileges or user interaction, and the changed scope with high confidentiality impact indicates database contents can be read across the WordPress store's data. Reported by Patchstack; no public exploit code or active exploitation has been identified at time of analysis.
Missing authorization in WCFM Marketplace WordPress plugin before 3.8.2 allows unauthenticated users to submit refund requests against any guest checkout order without verifying order ownership. The flaw (CWE-862) targets the refund request endpoint, which performs no ownership check for guest orders, enabling arbitrary financial disruption to marketplace vendors. A publicly available proof-of-concept exists; however, SSVC data confirms no active exploitation detected at time of analysis, and the patch is available in version 3.8.2.
SQL injection in the WCFM Marketplace plugin for WordPress allows authenticated high-privilege users (e.g., administrators or shop managers) to extract sensitive information from the site's database. Versions up to and including 3.7.1 are affected. No active exploitation or public exploit code has been identified, and EPSS indicates a very low probability of exploitation.
The WCFM Marketplace plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.4.11 due to missing nonce checks on various AJAX actions. Rated medium severity (CVSS 6.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Request Forgery (CSRF) vulnerability could allow attackers to trick authenticated users into performing unintended actions.
The WCFM Marketplace plugin for WordPress is vulnerable to unauthorized modification and access of data in versions up to, and including, 3.4.11 due to missing capability checks on various AJAX. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. This SQL Injection vulnerability could allow attackers to execute arbitrary SQL commands against the database.
Stored cross-site scripting in WCFM Marketplace (WordPress WooCommerce multivendor plugin) through version 3.8.2 allows authenticated contributors to inject persistent malicious JavaScript into marketplace content. When a higher-privileged user such as a site administrator or shop manager views the injected content, the payload executes within their browser session - enabling session hijacking, credential theft, or administrative actions performed on the attacker's behalf via the scope change. Reported by Patchstack; no public exploit code or active exploitation has been identified.
SQL injection in the WCFM Marketplace WordPress plugin (versions 3.8.1 and earlier) lets remote unauthenticated attackers inject arbitrary SQL into backend database queries. Per the CVSS vector this is exploitable over the network without privileges or user interaction, and the changed scope with high confidentiality impact indicates database contents can be read across the WordPress store's data. Reported by Patchstack; no public exploit code or active exploitation has been identified at time of analysis.
Missing authorization in WCFM Marketplace WordPress plugin before 3.8.2 allows unauthenticated users to submit refund requests against any guest checkout order without verifying order ownership. The flaw (CWE-862) targets the refund request endpoint, which performs no ownership check for guest orders, enabling arbitrary financial disruption to marketplace vendors. A publicly available proof-of-concept exists; however, SSVC data confirms no active exploitation detected at time of analysis, and the patch is available in version 3.8.2.
SQL injection in the WCFM Marketplace plugin for WordPress allows authenticated high-privilege users (e.g., administrators or shop managers) to extract sensitive information from the site's database. Versions up to and including 3.7.1 are affected. No active exploitation or public exploit code has been identified, and EPSS indicates a very low probability of exploitation.
The WCFM Marketplace plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.4.11 due to missing nonce checks on various AJAX actions. Rated medium severity (CVSS 6.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Request Forgery (CSRF) vulnerability could allow attackers to trick authenticated users into performing unintended actions.
The WCFM Marketplace plugin for WordPress is vulnerable to unauthorized modification and access of data in versions up to, and including, 3.4.11 due to missing capability checks on various AJAX. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. This SQL Injection vulnerability could allow attackers to execute arbitrary SQL commands against the database.