Extension WordPress
Vulnérabilités WCFM Marketplace – Multivendor Marketplace for WooCommerce
Cette page rassemble les failles publiées pour WCFM Marketplace – Multivendor Marketplace for WooCommerce, leurs plages de versions affectées et les correctifs signalés dans la base locale.
Historique de sécurité
CVE et vulnérabilités de WCFM Marketplace – Multivendor Marketplace for WooCommerce
9 fiches
WCFM Marketplace <= 3.7.3 – Authenticated (Vendor+) Stored Cross-Site Scripting via Attachment 'post_title'
The WCFM Marketplace – Multivendor Marketplace for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Attachment 'post_title' in all versions up to, and including, 3.7.3 due to insufficient input sanitization and output escaping. This makes…
*-3.7.3
3.7.4
10/07/2026
WCFM Marketplace – Multivendor Marketplace for WooCommerce <= 3.7.2 – Authenticated (Store vendor+) SQL Injection
The WCFM Marketplace – Multivendor Marketplace for WooCommerce plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 3.7.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on…
*-3.7.2
3.7.3
15/04/2026
WCFM Marketplace <= 3.7.0 – Insecure Direct Object Reference to Unauthenticated Arbitrary Refund Request Creation
The WCFM Marketplace – Multivendor Marketplace for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.7.0. This is due to the plugin not implementing authorization checks in the…
*-3.7.0
3.7.1
09/02/2026
WCFM Marketplace <= 3.7.3 – Missing Authorization
The WCFM Marketplace plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 3.7.3. This makes it possible for authenticated attackers, with store vendor-level access…
*-3.7.3
3.7.4
15/12/2025
WCFM Marketplace – Multivendor Marketplace for WooCommerce <= 3.6.11 – Reflected Cross-Site Scripting
The WCFM Marketplace – Multivendor Marketplace for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in all versions up to, and including, 3.6.11 due to insufficient input sanitization and output escaping. This makes it possible for…
*-3.6.11
3.6.12
16/09/2024
WCFM Marketplace <= 3.6.2 – Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
The WCFM Marketplace plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'wcfm_stores' shortcode in versions up to, and including, 3.6.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible…
*-3.6.2
3.6.3
23/11/2023
WCFM Marketplace <= 3.4.11 – Missing Authorization
The WCFM Marketplace plugin for WordPress is vulnerable to unauthorized modification and access of data in versions up to, and including, 3.4.11 due to missing capability checks on various AJAX actions. This makes it possible for authenticated attackers,…
*-3.4.11
3.4.12
05/04/2023
WCFM Marketplace <= 3.4.12 – Cross-Site Request Forgery
The WCFM Marketplace plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.4.11 due to missing nonce checks on various AJAX actions. This makes it possible for unauthenticated attackers to perform a…
*-3.4.12
3.5.0
05/04/2023
WCFM – WooCommerce Multivendor Marketplace <= 3.4.11 – Unauthenticated SQL Injection
The wcfm_ajax_controller AJAX action of the WCFM Marketplace WordPress plugin before 3.4.12, available to unauthenticated and authenticated user, does not properly sanitise multiple parameters before using them in SQL statements, leading to SQL injections
*-3.4.11
3.4.12
22/11/2021
Extensions également surveillés
WP Commander
Rechercher dans toute la base WordPress
Utilisez la recherche globale pour retrouver une extension, un thème, une CVE ou un identifiant de vulnérabilité.