Wclovers vulnerabilities
We track 13 vulnerabilities in Wclovers products across 7 products. 13 are rated high or critical, and none are known to be exploited. The most recent was published on September 18, 2026.
Latest Wclovers vulnerabilities
- 7.5 High severity
WCFM Marketplace – Multivendor Marketplace for…: Improper Neutralization of Special Elements used in an SQL Command
The WCFM Marketplace – Multivendor Marketplace for WooCommerce plugin for WordPress is vulnerable to generic SQL Injection via the 'wcfmmp_user_location_lng' parameter in all versions up to, and including, 3.8.2 due to insufficient escaping on the user supplie
- 8.1 High severity
WCFM Membership – WooCommerce Memberships for…: Authorization Bypass Through User-Controlled Key
The WCFM Membership – WooCommerce Memberships for Multivendor Marketplace plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.11.10. This is due to the 'wcfmvm_membership_change' AJAX action not valida
- 8.1 High severity
WCFM – Frontend Manager for WooCommerce: Authorization Bypass Through User-Controlled Key
The WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.7.25 via the 'wcfm_delete_wcfm_customer' due to miss
- 8.1 High severity
WCFM – Frontend Manager for WooCommerce: Authorization Bypass Through User-Controlled Key
The WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.7.25 via multiple AJAX actions including `wcfm_modif
- 7.2 High severity
WCFM – Frontend Manager for WooCommerce: Missing Authorization
The WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the 'WCFM_Settin
- 8.8 High severity
WCFM – Frontend Manager for WooCommerce: Authorization Bypass Through User-Controlled Key
The WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.7.12 via the WCFM_Customers_Manage_Controller::proce
- 9.8 Critical severity
WCFM Membership – WooCommerce Memberships for…: Authorization Bypass Through User-Controlled Key
The WCFM Membership – WooCommerce Memberships for Multivendor Marketplace plugin for WordPress is vulnerable to Insecure Direct Object References in versions up to, and including, 2.10.7. This is due to the plugin providing user-controlled access to objects, l
- 8.8 High severity
WCFM Membership – WooCommerce Memberships for…: Cross-Site Request Forgery
The WCFM Membership plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.9.10 due to missing nonce checks on various AJAX actions. This makes it possible for unauthenticated attackers to perform a wide variety of
- 9.8 Critical severity
WCFM Membership – WooCommerce Memberships for…: Missing Authorization
THe WCFM Membership plugin for WordPress is vulnerable to privilege escalation in versions up to, and including 2.10.0, due to a missing capability check on the wp_ajax_nopriv_wcfm_ajax_controller AJAX action that controls membership settings. This makes it po
- 8.8 High severity
WCFM – Frontend Manager for WooCommerce: Cross-Site Request Forgery
The WCFM Frontend Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 6.6.0 due to missing nonce checks on various AJAX actions. This makes it possible for unauthenticated attackers to perform a wide varie
- 8.8 High severity
WCFM – Frontend Manager for WooCommerce along…: Missing Authorization
The WCFM Frontend Manager plugin for WordPress is vulnerable to unauthorized modification and access of data in versions up to, and including, 6.6.0 due to missing capability checks on various AJAX actions. This makes it possible for authenticated attackers, w
- 8.8 High severity
WCFM Marketplace – Multivendor Marketplace for…: Cross-Site Request Forgery
The WCFM Marketplace plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.4.11 due to missing nonce checks on various AJAX actions. This makes it possible for unauthenticated attackers to perform a wide variety o
- 8.8 High severity
WCFM Marketplace – Multivendor Marketplace for…: Missing Authorization
The WCFM Marketplace plugin for WordPress is vulnerable to unauthorized modification and access of data in versions up to, and including, 3.4.11 due to missing capability checks on various AJAX actions. This makes it possible for authenticated attackers, with