WordPress plugin

WCFM Marketplace – Multivendor Marketplace for WooCommerce security & vulnerabilities

Q: Does WCFM Marketplace – Multivendor Marketplace for WooCommerce have known vulnerabilities?

Yes. VulnCrest Radar lists 17 known vulnerabilities in WCFM Marketplace – Multivendor Marketplace for WooCommerce: 1 critical, 3 high, 13 medium. None are known to affect version null.

Q: How do I check which version of WCFM Marketplace – Multivendor Marketplace for WooCommerce I run?

In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.

Q: What is the most recent WCFM Marketplace – Multivendor Marketplace for WooCommerce vulnerability?

CVE-2026-120849, published Nov 7, 2026: WCFM Marketplace – Multivendor Marketplace for WooCommerce <= 3.8.3 - Missing Authorization. Severity: Medium (CVSS 4.3).

Q: Is any WCFM Marketplace – Multivendor Marketplace for WooCommerce vulnerability listed in CISA KEV?

No. None of the known WCFM Marketplace – Multivendor Marketplace for WooCommerce vulnerabilities is currently listed in the CISA KEV catalog.

wc-multivendor-marketplace— active installsLast vulnerability Nov 7, 2026

No known unpatched vulnerabilities in the latest version

All 17 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.

Watch plugin

17Known vulnerabilities

Critical1
High3
Medium13
Low0

Vulnerabilities per year

All WCFM Marketplace – Multivendor Marketplace for WooCommerce vulnerabilities

WCFM Marketplace – Multivendor Marketplace for WooCommerce vulnerabilities
Severity	Vulnerability	CVE	Published
High7.5	Unauthenticated SQL Injection via 'wcfmmp_user_location_lat' / 'wcfmmp_user_location_lng' Parameter ≤3.8.2Update to 3.8.3	CVE-2026-18442	Sep 17
High7.5	Unauthenticated SQL Injection ≤3.8.1Update to 3.8.2	CVE-2026-81286	Sep 01
High8.8	Missing Authorization ≤3.4.11Update to 3.4.12	CVE-2022-4935	Apr 5, 2023
Critical9.8	WooCommerce Multivendor Marketplace <= 3.4.11 - Unauthenticated SQL Injection ≤3.4.11Update to 3.4.12	CVE-2021-24849	Nov 22, 2021

High7.5
Unauthenticated SQL Injection via 'wcfmmp_user_location_lat' / 'wcfmmp_user_location_lng' Parameter
≤3.8.2Update to 3.8.3
CVE-2026-18442Sep 17
High7.5
Unauthenticated SQL Injection
≤3.8.1Update to 3.8.2
CVE-2026-81286Sep 01
High8.8
Missing Authorization
≤3.4.11Update to 3.4.12
CVE-2022-4935Apr 5, 2023
Critical9.8
WooCommerce Multivendor Marketplace <= 3.4.11 - Unauthenticated SQL Injection
≤3.4.11Update to 3.4.12
CVE-2021-24849Nov 22, 2021

WCFM Marketplace – Multivendor Marketplace for WooCommerce: common questions

Does WCFM Marketplace – Multivendor Marketplace for WooCommerce have known vulnerabilities?

Yes. VulnCrest Radar lists 17 known vulnerabilities in WCFM Marketplace – Multivendor Marketplace for WooCommerce: 1 critical, 3 high, 13 medium. None are known to affect version null.

How do I check which version of WCFM Marketplace – Multivendor Marketplace for WooCommerce I run?

In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.

What is the most recent WCFM Marketplace – Multivendor Marketplace for WooCommerce vulnerability?

CVE-2026-120849, published Nov 7, 2026: WCFM Marketplace – Multivendor Marketplace for WooCommerce <= 3.8.3 - Missing Authorization. Severity: Medium (CVSS 4.3).

Is any WCFM Marketplace – Multivendor Marketplace for WooCommerce vulnerability listed in CISA KEV?

No. None of the known WCFM Marketplace – Multivendor Marketplace for WooCommerce vulnerabilities is currently listed in the CISA KEV catalog.