CVE-2026-83562: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in WC Lovers WCFM Marketplace

This vulnerability (CVE-2026-83562) is classified as CWE-79, indicating improper neutralization of input during web page generation leading to cross-site scripting (XSS). It affects WCFM Marketplace versions up to 3.8.2. The flaw allows a contributor-level user to inject malicious scripts that execute in the context of other users' browsers. The CVSS 3.1 base score is 6.5, reflecting a network attack vector with low attack complexity, requiring privileges and user interaction, and resulting in partial confidentiality, integrity, and availability impacts. No official patch or remediation guidance is currently available, and no known exploits are reported in the wild.

Successful exploitation could allow an attacker with contributor privileges to execute arbitrary scripts in the victim's browser, potentially leading to theft of sensitive information, session hijacking, or manipulation of web content. The impact affects confidentiality, integrity, and availability to a limited extent as indicated by the CVSS vector. However, exploitation requires user interaction and some privileges, limiting the scope of impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, limit contributor privileges where possible and educate users about the risks of interacting with untrusted content. Monitor vendor channels for updates and apply patches promptly once available.