WCFM Marketplace – Multivendor Marketplace for WooCommerce vulnerabilities

3 known vulnerabilities in WCFM Marketplace – Multivendor Marketplace for WooCommerce from Wclovers. 3 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.5 High severity

  WCFM Marketplace – Multivendor Marketplace for…: Improper Neutralization of Special Elements used in an SQL Command

  CVE-2026-18442Sep 18, 2026Wclovers

  The WCFM Marketplace – Multivendor Marketplace for WooCommerce plugin for WordPress is vulnerable to generic SQL Injection via the 'wcfmmp_user_location_lng' parameter in all versions up to, and including, 3.8.2 due to insufficient escaping on the user supplie

• 8.8 High severity

  WCFM Marketplace – Multivendor Marketplace for…: Cross-Site Request Forgery

  CVE-2022-4936Apr 5, 2023Wclovers

  The WCFM Marketplace plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.4.11 due to missing nonce checks on various AJAX actions. This makes it possible for unauthenticated attackers to perform a wide variety o

• 8.8 High severity

  WCFM Marketplace – Multivendor Marketplace for…: Missing Authorization

  CVE-2022-4935Apr 5, 2023Wclovers

  The WCFM Marketplace plugin for WordPress is vulnerable to unauthorized modification and access of data in versions up to, and including, 3.4.11 due to missing capability checks on various AJAX actions. This makes it possible for authenticated attackers, with