CVE-2026-120848Medium· 6.5▾ SunlitImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WC Lovers WCFM Marketplace wc-multivendor-marketplace allows Stored XSS.This issue affects WCFM Marketplace: from n/a through 3.8.3.
▾ Sunlit zone — Low / medium · no exploitation signal
impact 35.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.2%
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WC Lovers WCFM Marketplace wc-multivendor-marketplace allows Stored XSS.This issue affects WCFM Marketplace: from n/a through 3.8.3.
wc-multivendor-marketplace <= 3.8.3Update the WordPress WCFM Marketplace plugin to the latest available version (at least 3.8.4).
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-120849Medium· 4.3WordPress WCFM Marketplace plugin <= 3.8.3 - Broken Access Control vulnerability
CVE-2026-39744High· 7.1WordPress WCFM Membership plugin <= 2.12.0 - Cross Site Scripting (XSS) vulnerability
CVE-2026-62000High· 7.5WordPress WCFM Marketplace plugin <= 3.8.2 - Broken Access Control vulnerability
CVE-2026-61990Medium· 4.3WordPress WCFM Membership plugin <= 2.12.0 - Broken Access Control vulnerability
CVE-2026-39743Medium· 5.3WordPress WCFM Membership plugin <= 2.12.0 - Broken Access Control vulnerability
CVE-2026-39777Medium· 4.3WordPress WCFM Membership plugin <= 2.12.0 - Broken Access Control vulnerability