VulnCrest
Search
Create account
Report an incident
Radar sectionsPlugins & themes
Check my site

WordPress plugin

WCFM Marketplace – Multivendor Marketplace for WooCommerce security & vulnerabilities

wc-multivendor-marketplace— active installsLast vulnerability Nov 7, 2026

No known unpatched vulnerabilities in the latest version

All 17 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.

Watch plugin
17Known vulnerabilities
  • Critical1
  • High3
  • Medium13
  • Low0
Vulnerabilities per year
2021: 1 vulnerability1212023: 3 vulnerabilities3232024: 1 vulnerability1242025: 1 vulnerability1252026: 11 vulnerabilities1126

All WCFM Marketplace – Multivendor Marketplace for WooCommerce vulnerabilities

WCFM Marketplace – Multivendor Marketplace for WooCommerce vulnerabilities
SeverityVulnerabilityCVEPublished
Medium4.3Missing Authorization
≤3.8.3Update to 3.8.4
CVE-2026-120849
Medium6.4Authenticated (Vendor+) Stored Cross-Site Scripting
≤3.8.3Update to 3.8.4
CVE-2026-120848
Medium5.3Missing Authorization
≤3.8.2Update to 3.8.3
CVE-2026-62000
High7.5Unauthenticated SQL Injection via 'wcfmmp_user_location_lat' / 'wcfmmp_user_location_lng' Parameter
≤3.8.2Update to 3.8.3
CVE-2026-18442
High7.5Unauthenticated SQL Injection
≤3.8.1Update to 3.8.2
CVE-2026-81286
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤3.8.2Update to 3.8.3
CVE-2026-83562
Medium5.3Insecure Direct Object Reference to Unauthenticated Arbitrary Order Refund Request
<3.8.2Update to 3.8.2
CVE-2026-77701
Medium5.4Insecure Direct Object Reference to Authenticated (Store vendor+) Cross-Vendor Review Deletion and Status Update
≤3.8.0Update to 3.8.1
CVE-2026-14196
Medium6.4Authenticated (Vendor+) Stored Cross-Site Scripting via Attachment 'post_title'
≤3.7.3Update to 3.7.4
CVE-2026-12126
Medium6.5Authenticated (Store vendor+) SQL Injection
≤3.7.2Update to 3.7.3
CVE-2025-63029
Medium5.3Insecure Direct Object Reference to Unauthenticated Arbitrary Refund Request Creation
≤3.7.0Update to 3.7.1
CVE-2026-1722
Medium4.3Missing Authorization
≤3.7.3Update to 3.7.4
CVE-2025-64631
Medium6.1Reflected Cross-Site Scripting
≤3.6.11Update to 3.6.12
CVE-2024-44009
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
≤3.6.2Update to 3.6.3
CVE-2023-4960
High8.8Missing Authorization
≤3.4.11Update to 3.4.12
CVE-2022-4935
Medium6.3Cross-Site Request Forgery
≤3.4.12Update to 3.5.0
CVE-2022-4936
Critical9.8WooCommerce Multivendor Marketplace <= 3.4.11 - Unauthenticated SQL Injection
≤3.4.11Update to 3.4.12
CVE-2021-24849

WCFM Marketplace – Multivendor Marketplace for WooCommerce: common questions

Does WCFM Marketplace – Multivendor Marketplace for WooCommerce have known vulnerabilities?

Yes. VulnCrest Radar lists 17 known vulnerabilities in WCFM Marketplace – Multivendor Marketplace for WooCommerce: 1 critical, 3 high, 13 medium. None are known to affect version null.

How do I check which version of WCFM Marketplace – Multivendor Marketplace for WooCommerce I run?

In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.

What is the most recent WCFM Marketplace – Multivendor Marketplace for WooCommerce vulnerability?

CVE-2026-120849, published Nov 7, 2026: WCFM Marketplace – Multivendor Marketplace for WooCommerce <= 3.8.3 - Missing Authorization. Severity: Medium (CVSS 4.3).

Is any WCFM Marketplace – Multivendor Marketplace for WooCommerce vulnerability listed in CISA KEV?

No. None of the known WCFM Marketplace – Multivendor Marketplace for WooCommerce vulnerabilities is currently listed in the CISA KEV catalog.

Search VulnCrest Radar

Jump to

Are you sure?