CVE-2026-83562
MediumCVSS 6.5Summary
Contributor Cross Site Scripting (XSS) vulnerability in WCFM Marketplace versions up to 3.8.2. A user with Contributor role can inject malicious script.
Risk Assessment
Potential for malicious script execution in other users' browsers, potentially leading to session theft or other attacks.
Recommendation
Update the WCFM Marketplace plugin to the latest version that includes security fixes.
Other vulnerabilities in WCFM Marketplace
See all- CVE-2026-81286Critical
Unauthenticated SQL Injection in WCFM Marketplace <= 3.8.1 versions.
- CVE-2026-12126Medium
The WCFM Marketplace plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to 3.7.3 due to insufficient input sanitization and output escaping of the 'post_title' field. Authenticated attackers with Vendor-level access or higher can inject arbitrary web scripts that execute when users access affected pages.
Original NVD description (English source)
Contributor Cross Site Scripting (XSS) in WCFM Marketplace <= 3.8.2 versions.