Skip to content
OpenAdvisories
High · 7.6 CVE-2025-63029 EUVD-2025-209485GHSA-m7v3-c773-h4rx

WordPress WCFM Marketplace plugin <= 3.7.1 - SQL Injection vulnerability

Published Apr 15, 2026 · Updated Apr 28, 2026 · Assigned by Patchstack

Description

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WC Lovers WCFM Marketplace wc-multivendor-marketplace allows SQL Injection.This issue affects WCFM Marketplace: from n/a through <= 3.7.1.

Affected products

VendorProductAffectedFixed
WC Lovers WCFM Marketplace ≤ 3.7.1 —

References