Read the docs

wclovers

Records44All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical4CVSS 9.0–10.0
CVSS high21CVSS 7.0–8.9

Exploited now

wclovers records in CISA KEV

No wclovers vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Frontend Manager For Woocommerce Along With Bookings Subscription Listings Compatible 6 records MEDIUM Wcfm Marketplace 4 records MEDIUM Wcfm Membership 4 records MEDIUM Woocommerce Multivendor Marketplace 1 record LOW

Records

4 records in Wcfm Marketplace · all components

TI-2022-04526 CVE-2022-4935 · GHSA-c6p6-wm7f-rgmj

WCFM Marketplace <= 3.4.11 - Missing Authorization

Priority MEDIUM 41

The WCFM Marketplace plugin for WordPress is vulnerable to unauthorized modification and access of data in versions up to, and including, 3.4.11 due to missing capability checks on various AJAX actions.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00723 Published 2023-04-05 No fix listed CWE-89
TI-2022-04527 CVE-2022-4936 · GHSA-3q7c-mxc6-45v4

WCFM Marketplace <= 3.4.12 - Cross-Site Request Forgery

Priority LOW 38

The WCFM Marketplace plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.4.11 due to missing nonce checks on various AJAX actions.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00248 Published 2023-04-05 No fix listed CWE-352
TI-2023-04565 CVE-2023-4960 · GHSA-63h3-hrqg-7f66

WCFM Marketplace <= 3.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

Priority LOW 29

The WCFM Marketplace plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'wcfm_stores' shortcode in versions up to, and including, 3.6.2 due to insufficient input sanitization and output escaping on use…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00439 Published 2024-01-11 No fix listed CWE-79
Open these records in search →