Plugin icon

WCFM Marketplace – Multivendor Marketplace for WooCommerce

wc-multivendor-marketplace

Vulnerabilities:

10

Last Updated:

August 14, 2026

Active Installs:

10000

Published
Title
Fixed in
CVSS
Published
2026-08-17
Title
WCFM Marketplace < 3.8.1 - Store Vendor+ Cross-Vendor Review Deletion and Status Update via IDOR
Fixed in
Fixed in 3.8.1
CVSS
4.3 (medium)
Published
2026-07-10
Title
WCFM Marketplace < 3.7.4 - Authenticated (Vendor+) Stored Cross-Site Scripting via Attachment 'post_title'
Fixed in
Fixed in 3.7.4
CVSS
6.4 (medium)
Published
2026-04-15
Title
WCFM Marketplace – Multivendor Marketplace for WooCommerce < 3.7.3 - Authenticated (Store vendor+) SQL Injection
Fixed in
Fixed in 3.7.3
CVSS
6.5 (medium)
Published
2026-02-09
Title
WCFM Marketplace < 3.7.1 - Insecure Direct Object Reference to Unauthenticated Arbitrary Refund Request Creation
Fixed in
Fixed in 3.7.1
CVSS
5.3 (medium)
Published
2025-12-15
Title
WCFM Marketplace < 3.7.4 - Missing Authorization
Fixed in
Fixed in 3.7.4
CVSS
4.3 (medium)
Published
2024-09-16
Title
WCFM Marketplace – Multivendor Marketplace for WooCommerce < 3.6.12 - Reflected Cross-Site Scripting
Fixed in
Fixed in 3.6.12
CVSS
6.1 (medium)
Published
2023-11-23
Title
WCFM Marketplace < 3.6.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Fixed in
Fixed in 3.6.3
CVSS
6.4 (medium)
Published
2023-04-05
Title
WCFM Marketplace < 3.4.12 - Subscriber+ Unauthorised AJAX Calls
Fixed in
Fixed in 3.4.12
CVSS
8.8 (high)
Published
2023-04-05
Title
WCFM Marketplace < 3.5.0 - Multiple CSRF
Fixed in
Fixed in 3.5.0
CVSS
6.3 (medium)
Published
2021-11-22
Title
WCFM - WooCommerce Multivendor Marketplace < 3.4.12 - Unauthenticated SQL Injection
Fixed in
Fixed in 3.4.12
CVSS
8.6 (high)