Plugin icon

WCFM Marketplace – Multivendor Marketplace for WooCommerce

wc-multivendor-marketplace

Vulnerabilities:

8

Last Updated:

April 25, 2026

Active Installs:

10000

Published
Title
Fixed in
CVSS
Published
2026-04-15
Title
WCFM Marketplace – Multivendor Marketplace for WooCommerce <= 3.7.1 - Authenticated (Store vendor+) SQL Injection
Fixed in
No known fix
CVSS
6.5 (medium)
Published
2026-02-09
Title
WCFM Marketplace < 3.7.1 - Insecure Direct Object Reference to Unauthenticated Arbitrary Refund Request Creation
Fixed in
Fixed in 3.7.1
CVSS
5.3 (medium)
Published
2025-12-15
Title
WCFM Marketplace <= 3.6.17 - Missing Authorization
Fixed in
No known fix
CVSS
4.3 (medium)
Published
2024-09-16
Title
WCFM Marketplace – Multivendor Marketplace for WooCommerce < 3.6.12 - Reflected Cross-Site Scripting
Fixed in
Fixed in 3.6.12
CVSS
6.1 (medium)
Published
2023-11-23
Title
WCFM Marketplace < 3.6.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Fixed in
Fixed in 3.6.3
CVSS
6.4 (medium)
Published
2023-04-05
Title
WCFM Marketplace < 3.4.12 - Subscriber+ Unauthorised AJAX Calls
Fixed in
Fixed in 3.4.12
CVSS
8.8 (high)
Published
2023-04-05
Title
WCFM Marketplace < 3.5.0 - Multiple CSRF
Fixed in
Fixed in 3.5.0
CVSS
6.3 (medium)
Published
2021-11-22
Title
WCFM - WooCommerce Multivendor Marketplace < 3.4.12 - Unauthenticated SQL Injection
Fixed in
Fixed in 3.4.12
CVSS
8.6 (high)