Advisories · Technology
wclovers WCFM Marketplace – Multivendor Marketplace for WooCommerce.
Every CVE that names wclovers WCFM Marketplace – Multivendor Marketplace for WooCommerce among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 7.5 High
WCFM Marketplace <= 3.8.2 - Unauthenticated SQL Injection via 'wcfmmp_user_location_lat' / 'wcfmmp_user_location_lng' Parameter
- wclovers WCFM Marketplace – Multivendor Marketplace for WooCommerce
- SQL injection
- CVSS 6.4 Medium
WCFM Marketplace <= 3.7.3 - Authenticated (Vendor+) Stored Cross-Site Scripting via Attachment 'post_title'
- wclovers WCFM Marketplace – Multivendor Marketplace for WooCommerce
- Cross-site scripting (XSS)
- CVSS 5.3 Medium
WCFM Marketplace <= 3.7.0 - Insecure Direct Object Reference to Unauthenticated Arbitrary Refund Request Creation
- wclovers WCFM Marketplace – Multivendor Marketplace for WooCommerce
- Broken access control
- CVSS 6.4 Medium
WCFM Marketplace <= 3.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
- wclovers WCFM Marketplace – Multivendor Marketplace for WooCommerce
- Cross-site scripting (XSS)
- CVSS 6.3 Medium
WCFM Marketplace <= 3.4.12 - Cross-Site Request Forgery
- wclovers WCFM Marketplace – Multivendor Marketplace for WooCommerce
- Cross-site request forgery (CSRF)
- CVSS 8.8 High
WCFM Marketplace <= 3.4.11 - Missing Authorization
- wclovers WCFM Marketplace – Multivendor Marketplace for WooCommerce
- SQL injection