wclovers vulnerabilities
23 published CVEs name wclovers among the affected products.
- 23Published CVEs23 of them scored
- 10Last 12 monthspublished in the last year
- 2Critical8 more rated high
- 0Known exploitedin CISA's KEV catalog
Newest CVEs
- CVE-2026-18442
WCFM Marketplace <= 3.8.2 - Unauthenticated SQL Injection via 'wcfmmp_user_location_lat' / 'wcfmmp_user_location_lng' Parameter
wclovers · WCFM Marketplace – Multivendor Marketplace for WooCommerce
High7.5 - CVE-2026-10041
WCFM – Frontend Manager for WooCommerce <= 6.7.27 - Authenticated (Subscriber+) Missing Authorization to Arbitrary Vendor Data Manipulation via Multiple AJAX Handlers
wclovers · WCFM – Frontend Manager for WooCommerce
Medium4.3 - CVE-2026-12126
WCFM Marketplace <= 3.7.3 - Authenticated (Vendor+) Stored Cross-Site Scripting via Attachment 'post_title'
wclovers · WCFM Marketplace – Multivendor Marketplace for WooCommerce
Medium6.4 - CVE-2026-12994
WCFM – Frontend Manager for WooCommerce <= 6.7.27 - Missing Authorization to Unauthenticated Arbitrary Inquiry Reply Injection via wcfm-my-account-enquiry-manage Controller
wclovers · WCFM – Frontend Manager for WooCommerce
Medium5.3 - CVE-2026-3688
WCFM - WooCommerce Multivendor Membership <= 2.11.10 - Insecure Direct Object Reference to Limited Privilege Escalation via User Role Overwrite
wclovers · WCFM Membership – WooCommerce Memberships for Multivendor Marketplace
High8.1 - CVE-2026-2554
WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible <= 6.7.25 - Authenticated (Vendor+) Insecure Direct Object Reference to Arbitrary User Deletion
wclovers · WCFM – Frontend Manager for WooCommerce
High8.1 - CVE-2026-4896
WCFM - WooCommerce Frontend Manager <= 6.7.25 - Insecure Direct Object References to Autenticated (Vendor+) Arbitrary Post/Product Manipulation
wclovers · WCFM – Frontend Manager for WooCommerce
High8.1 - CVE-2026-1722
WCFM Marketplace <= 3.7.0 - Insecure Direct Object Reference to Unauthenticated Arbitrary Refund Request Creation
wclovers · WCFM Marketplace – Multivendor Marketplace for WooCommerce
Medium5.3 - CVE-2025-15147
WCFM Membership – WooCommerce Memberships for Multivendor Marketplace <= 2.11.8 - Insecure Direct Object Reference to Update Membership Payment
wclovers · WCFM Membership – WooCommerce Memberships for Multivendor Marketplace
Medium4.3 - CVE-2026-0845
WCFM - WooCommerce Frontend Manager <= 6.7.24 - Authenticated (Shop Manager+) Arbitrary Options Update
wclovers · WCFM – Frontend Manager for WooCommerce
High7.2