Plugin icon

WCFM – Frontend Manager for WooCommerce

wc-frontend-manager

Vulnerabilities:

9

Last Updated:

March 16, 2026

Active Installs:

20000

Published
Title
Fixed in
CVSS
Published
2026-04-03
Title
WCFM - WooCommerce Frontend Manager < 6.7.26 - Insecure Direct Object References to Autenticated (Vendor+) Arbitrary Post/Product Manipulation
Fixed in
Fixed in 6.7.26
CVSS
8.1 (high)
Published
2026-02-09
Title
WCFM - WooCommerce Frontend Manager < 6.7.25 - Authenticated (Shop Manager+) Arbitrary Options Update
Fixed in
Fixed in 6.7.25
CVSS
7.2 (high)
Published
2025-12-15
Title
WCFM – Frontend Manager for WooCommerce < 6.7.25 - Missing Authorization
Fixed in
Fixed in 6.7.25
CVSS
4.3 (medium)
Published
2025-07-08
Title
WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible < 6.7.17 - Missing Authorization to Unauthenticated Plugin Settings Modification
Fixed in
Fixed in 6.7.17
CVSS
6.5 (medium)
Published
2024-09-24
Title
WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible < 6.7.13 - Insecure Direct Object Reference to Account Takeover/Privilege Escalation
Fixed in
Fixed in 6.7.13
CVSS
8.8 (high)
Published
2024-03-25
Title
WCFM – Frontend Manager for WooCommerce < 6.7.9 - Authenticated (Shop manager+) Stored Cross-Site Scripting
Fixed in
Fixed in 6.7.9
CVSS
4.4 (medium)
Published
2023-04-05
Title
WCFM Frontend Manager < 6.6.0 - Multiple CSRF
Fixed in
Fixed in 6.6.0
CVSS
5.4 (medium)
Published
2023-04-05
Title
WCFM Frontend Manager < 6.6.1 - Subscriber+ Unauthorised AJAX Calls
Fixed in
Fixed in 6.6.1
CVSS
5.4 (medium)
Published
2021-10-11
Title
WCFM - Frontend Manager for WooCommerce < 6.5.12 - Customer/Subscriber+ SQL Injection
Fixed in
Fixed in 6.5.12
CVSS
7.7 (high)