Wclovers
18 CVEs across 9 Wclovers products. Browse Wclovers vulnerabilities, severities, and proof-of-concept exploits.
Wclovers products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-12994 | Medium | 5.3 | 2026-07-11 | The WCFM – Frontend Manager for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.7.27. This is du… |
CVE-2026-12126 | Medium | 6.4 | 2026-07-11 | The WCFM Marketplace – Multivendor Marketplace for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Attachment 'post_title' in… |
CVE-2026-10041 | Medium | 4.3 | 2026-07-11 | The WCFM – Frontend Manager for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.7.27… |
CVE-2026-3688 | High | 8.1 | 2026-07-08 | The WCFM Membership – WooCommerce Memberships for Multivendor Marketplace plugin for WordPress is vulnerable to Insecure Direct Object Reference in all version… |
CVE-2026-2554 | High | 8.1 | 2026-05-02 | The WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible plugin for WordPress is vulnerable to Insecure Direct Object R… |
CVE-2026-4896 | High | 8.1 | 2026-04-04 | The WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible plugin for WordPress is vulnerable to Insecure Direct Object R… |
CVE-2026-1722 | Medium | 5.3 | 2026-02-10 | The WCFM Marketplace – Multivendor Marketplace for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, an… |
CVE-2026-0845 | High | 7.2 | 2026-02-10 | The WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible plugin for WordPress is vulnerable to unauthorized modificatio… |
CVE-2025-15147 | Medium | 4.3 | 2026-02-10 | The WCFM Membership – WooCommerce Memberships for Multivendor Marketplace plugin for WordPress is vulnerable to Insecure Direct Object Reference in all version… |
CVE-2025-3780 | Medium | 6.5 | 2025-07-09 | The WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible plugin for WordPress is vulnerable to unauthorized modificatio… |
CVE-2025-1311 | Medium | 6.5 | 2025-03-22 | The WooCommerce Multivendor Marketplace – REST API plugin for WordPress is vulnerable to SQL Injection via the 'id' parameter in the update_delivery_status() f… |
CVE-2024-8290 | High | 8.8 | 2024-09-25 | The WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible plugin for WordPress is vulnerable to Insecure Direct Object R… |
CVE-2024-44009 | High | 7.1 | 2024-09-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WC Lovers WCFM Marketplace wc-multivendor-marketplace all… |
CVE-2023-4960 | Medium | 6.4 | 2024-01-11 | The WCFM Marketplace plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'wcfm_stores' shortcode in versions up to, and including, 3.6.2 due… |
CVE-2023-2275 | Medium | 4.3 | 2023-06-09 | The WooCommerce Multivendor Marketplace – REST API plugin for WordPress is vulnerable to unauthorized access of data and addition of data due to a missing capa… |
CVE-2023-2276 | Critical | 9.8 | 2023-05-20 | The WCFM Membership – WooCommerce Memberships for Multivendor Marketplace plugin for WordPress is vulnerable to Insecure Direct Object References in versions u… |
CVE-2022-4941 | Medium | 6.3 | 2023-04-05 | The WCFM Membership plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.9.10 due to missing nonce checks on va… |
CVE-2022-4940 | High | 7.3 | 2023-04-05 | The WCFM Membership plugin for WordPress is vulnerable to unauthorized modification and access of data in versions up to, and including, 2.10.0 due to missing… |
CVE-2022-4939 | Critical | 9.8 | 2023-04-05 | THe WCFM Membership plugin for WordPress is vulnerable to privilege escalation in versions up to, and including 2.10.0, due to a missing capability check on th… |
CVE-2022-4938 | Medium | 6.3 | 2023-04-05 | The WCFM Frontend Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 6.6.0 due to missing nonce checks… |
CVE-2022-4937 | Medium | 6.3 | 2023-04-05 | The WCFM Frontend Manager plugin for WordPress is vulnerable to unauthorized modification and access of data in versions up to, and including, 6.6.0 due to mis… |
CVE-2022-4936 | Medium | 6.3 | 2023-04-05 | The WCFM Marketplace plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.4.11 due to missing nonce checks on v… |
CVE-2022-4935 | High | 8.8 | 2023-04-05 | The WCFM Marketplace plugin for WordPress is vulnerable to unauthorized modification and access of data in versions up to, and including, 3.4.11 due to missing… |
CVE-2021-24849 | Critical | 9.8 | 2021-12-21 | The wcfm_ajax_controller AJAX action of the WCFM Marketplace WordPress plugin before 3.4.12, available to unauthenticated and authenticated user, does not prop… |
CVE-2021-24835 | High | 8.8 | 2021-11-08 | The WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible WordPress plugin before 6.5.12, when used in combination with… |