Wcfm Marketplace Multivendor Marketplace For Woocommerce
Monthly
Unauthenticated SQL injection in the WCFM Marketplace (Multivendor Marketplace for WooCommerce) WordPress plugin affects all versions up to and including 3.8.2, allowing remote attackers to inject arbitrary SQL through the 'wcfmmp_user_location_lng' parameter and read sensitive data from the underlying WordPress database. Rated CVSS 3.1 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), the flaw requires no authentication, privileges, or user interaction, although practical reachability depends on the store actually exercising the plugin's location/distance-based shipping code path alongside an active WooCommerce install. No confirmed active exploitation (the issue is not in CISA KEV) and no public exploit code identified at time of analysis; an upstream fix commit is visible in the plugin repository, but a released patched version has not been independently confirmed.
Stored XSS in WCFM Marketplace - Multivendor Marketplace for WooCommerce (all versions ≤ 3.7.3) permits authenticated attackers holding a Vendor-level account to plant persistent JavaScript payloads inside WordPress media attachment titles, targeting any privileged user who subsequently loads the media management dashboard. The injection path is notable for its stealth: the attacker uploads a media file with a crafted post_title via the standard WordPress REST API (/wp-json/wp/v2/media), bypassing any AJAX-based access controls, because the unescaped title is later serialized into DataTables JSON and written directly to the DOM via innerHTML on the admin media interface. No public exploit code is identified and the vulnerability has no CISA KEV listing at time of analysis, but the low privilege barrier - any marketplace vendor account - meaningfully elevates real-world risk in multi-vendor deployments with untrusted sellers.
Unauthenticated SQL injection in the WCFM Marketplace (Multivendor Marketplace for WooCommerce) WordPress plugin affects all versions up to and including 3.8.2, allowing remote attackers to inject arbitrary SQL through the 'wcfmmp_user_location_lng' parameter and read sensitive data from the underlying WordPress database. Rated CVSS 3.1 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), the flaw requires no authentication, privileges, or user interaction, although practical reachability depends on the store actually exercising the plugin's location/distance-based shipping code path alongside an active WooCommerce install. No confirmed active exploitation (the issue is not in CISA KEV) and no public exploit code identified at time of analysis; an upstream fix commit is visible in the plugin repository, but a released patched version has not been independently confirmed.
Stored XSS in WCFM Marketplace - Multivendor Marketplace for WooCommerce (all versions ≤ 3.7.3) permits authenticated attackers holding a Vendor-level account to plant persistent JavaScript payloads inside WordPress media attachment titles, targeting any privileged user who subsequently loads the media management dashboard. The injection path is notable for its stealth: the attacker uploads a media file with a crafted post_title via the standard WordPress REST API (/wp-json/wp/v2/media), bypassing any AJAX-based access controls, because the unescaped title is later serialized into DataTables JSON and written directly to the DOM via innerHTML on the admin media interface. No public exploit code is identified and the vulnerability has no CISA KEV listing at time of analysis, but the low privilege barrier - any marketplace vendor account - meaningfully elevates real-world risk in multi-vendor deployments with untrusted sellers.