Threat database

12 threats

Threat database
Severity	CVSS	Signals	Threat	Source	Published
High	7.5	EPSS 0.4%	CVE-2026-39794WooCommerce Multivendor Marketplace – REST API · Missing Authorization High7.5EPSS 0.4%2026-10-06CVE Database V5CVE-2026-39794 Unauthenticated Broken Access Control in WooCommerce Multivendor Marketplace – REST API <= 1.6.3 versions. EPSS 0.4%Vulnerability WC Lovers #cwe-862	CVE Database V5	2026-10-06
Medium	5.3	EPSS 0.3%	CVE-2026-32480WCFM Membership · Missing Authorization Medium5.3EPSS 0.3%2026-09-04CVE Database V5CVE-2026-32480 Missing Authorization vulnerability in WC Lovers WCFM Membership allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WCFM Membership: from n/a through 2.11.11. EPSS 0.3%Vulnerability WC Lovers #cwe-862 #ghsa-rxqj-65pp-pjhr	CVE Database V5	2026-09-04
High	7.1	EPSS 0.3%	CVE-2026-84756WCFM Membership · Incorrect Privilege Assignment High7.1EPSS 0.3%2026-09-03CVE Database V5CVE-2026-84756 Subscriber Privilege Escalation in WCFM Membership <= 2.11.11 versions. EPSS 0.3%Vulnerability WC Lovers #cwe-266	CVE Database V5	2026-09-03
Medium	6.5	EPSS 0.2%	CVE-2026-83562WCFM Marketplace · Cross-site Scripting Medium6.5EPSS 0.2%2026-09-02CVE Database V5CVE-2026-83562 Contributor Cross Site Scripting (XSS) in WCFM Marketplace <= 3.8.2 versions. EPSS 0.2%Vulnerability WC Lovers #cwe-79 #ghsa-44q9-95m2-m9qg	CVE Database V5	2026-09-02
Critical	9.3	EPSS 0.4%	CVE-2026-81286WCFM Marketplace · SQL Injection Critical9.3EPSS 0.4%2026-09-02CVE Database V5CVE-2026-81286 Unauthenticated SQL Injection in WCFM Marketplace <= 3.8.1 versions. EPSS 0.4%Vulnerability WC Lovers #cwe-89 #ghsa-7g84-hf36-28w5	CVE Database V5	2026-09-02
High	8.5	EPSS 0.3%	CVE-2026-22335WooCommerce Frontend Manager – Ultimate · SQL Injection High8.5EPSS 0.3%2026-06-17CVE Database V5CVE-2026-22335 CVE-2026-22335 is a high severity SQL Injection vulnerability affecting WooCommerce Frontend Manager – Ultimate versions prior to 6.7.7. It allows an attacker with low privileges to inject SQL commands via subscriber-related inputs, potentially leading to complete compromise of confidentiality and partial denial of service. No official patch or remediation guidance is currently confirmed from the vendor. Users should monitor vendor advisories for updates and apply patches once available. EPSS 0.3%Vulnerability WC Lovers.#cwe-89	CVE Database V5	2026-06-17
High	7.3	EPSS 0.3%	CVE-2026-42753WCFM Membership · Missing Authorization High7.3EPSS 0.3%2026-05-27CVE Database V5CVE-2026-42753 Missing Authorization vulnerability in WC Lovers WCFM Membership wc-multivendor-membership allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WCFM Membership: from n/a through <= 2.11.10. EPSS 0.3%Vulnerability WC Lovers	CVE Database V5	2026-05-27
High	7.6	EPSS 0.3%	CVE-2025-63029WCFM Marketplace · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in WC Lovers WCFM… High7.6EPSS 0.3%2026-04-15CVE Database V5CVE-2025-63029 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WC Lovers WCFM Marketplace wc-multivendor-marketplace allows SQL Injection.This issue affects WCFM Marketplace: from n/a through <= 3.7.1. EPSS 0.3%Vulnerability WC Lovers	CVE Database V5	2026-04-15
Medium	4.9	EPSS 0.3%	CVE-2025-64631WCFM Marketplace · Missing Authorization Medium4.9EPSS 0.3%2025-12-16CVE Database V5CVE-2025-64631 Missing Authorization vulnerability in WC Lovers WCFM Marketplace wc-multivendor-marketplace allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WCFM Marketplace: from n/a through <= 3.7.1. EPSS 0.3%Vulnerability WC Lovers	CVE Database V5	2025-12-16
Low	2.7	EPSS 0.3%	CVE-2025-54004WCFM – Frontend Manager for WooCommerce · Missing Authorization Low2.7EPSS 0.3%2025-12-16CVE Database V5CVE-2025-54004 Missing Authorization vulnerability in WC Lovers WCFM – Frontend Manager for WooCommerce wc-frontend-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WCFM – Frontend Manager for WooCommerce: from n/a through <= 6.7.24. EPSS 0.3%Vulnerability WC Lovers #cwe-862	CVE Database V5	2025-12-16
High	7.1	EPSS 0.3%	CVE-2024-44009WCFM Marketplace · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in WC Lovers WCFM… High7.1EPSS 0.3%2024-09-17CVE Database V5CVE-2024-44009 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WC Lovers WCFM Marketplace wc-multivendor-marketplace allows Reflected XSS.This issue affects WCFM Marketplace: from n/a through <= 3.6.11. EPSS 0.3%Vulnerability WC Lovers	CVE Database V5	2024-09-17
Medium	5.9	EPSS 0.4%	CVE-2024-29929WCFM – Frontend Manager for WooCommerce · Cross-site Scripting Medium5.9EPSS 0.4%2024-03-27CVE Database V5CVE-2024-29929 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WC Lovers WCFM – Frontend Manager for WooCommerce allows Stored XSS.This issue affects WCFM – Frontend Manager for WooCommerce: from n/a through 6.7.8. EPSS 0.4%Vulnerability WC Lovers #cwe-79	CVE Database V5	2024-03-27

Showing 1–12 of 12 results