CVE-2026-12126 is a stored cross-site scripting vulnerability (CWE-79) in the WCFM Marketplace – Multivendor Marketplace for WooCommerce plugin for WordPress. It affects all versions up to and including 3.7.3. The flaw is due to improper neutralization of input during web page generation, specifically insufficient sanitization and output escaping of the 'post_title' field in media attachments. Authenticated attackers with Vendor-level privileges or higher can upload media with crafted titles via the WordPress REST API (/wp-json/wp/v2/media). These malicious titles are later embedded unescaped in DataTables JSON and rendered as innerHTML in the media dashboard, causing arbitrary script execution for privileged users viewing the page.

An attacker with Vendor-level or higher privileges can inject persistent malicious scripts that execute in the browsers of privileged users accessing the media dashboard. This can lead to unauthorized actions performed with the victim's privileges, data theft, or session hijacking. The vulnerability does not affect unauthenticated users and requires at least Vendor-level access. The CVSS 3.1 base score is 6.4 (medium severity), reflecting network attack vector, low attack complexity, privileges required, no user interaction, and partial confidentiality and integrity impact without availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch is currently documented. Until a patch is available, restrict Vendor-level access to trusted users only and monitor for suspicious activity. Consider applying custom input sanitization or output escaping as a temporary mitigation if feasible. Avoid loading the media dashboard with untrusted content where possible.