All packages
WCFM Marketplace vulnerabilities
3 known CVE vulnerabilities in WCFM Marketplace, translated and rated.
- CVE-2026-83562Medium
Contributor Cross Site Scripting (XSS) vulnerability in WCFM Marketplace versions up to 3.8.2. A user with Contributor role can inject malicious script.
- CVE-2026-81286Critical
Unauthenticated SQL Injection in WCFM Marketplace <= 3.8.1 versions.
- CVE-2026-12126Medium
The WCFM Marketplace plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to 3.7.3 due to insufficient input sanitization and output escaping of the 'post_title' field. Authenticated attackers with Vendor-level access or higher can inject arbitrary web scripts that execute when users access affected pages.