Medium · 6.5 CVE-2026-83562 EUVD-2026-69934GHSA-44q9-95m2-m9qg

WordPress WCFM Marketplace plugin <= 3.8.2 - Cross Site Scripting (XSS) vulnerability

Published Sep 2, 2026 · Updated Sep 2, 2026 · Assigned by Patchstack

Vendor: WC Lovers Product: WCFM Marketplace

Description

Contributor Cross Site Scripting (XSS) in WCFM Marketplace <= 3.8.2 versions.

Affected products

Vendor	Product	Affected	Fixed
WC Lovers	WCFM Marketplace	≤ 3.8.2	—

References

https://patchstack.com/database/wordpress/plugin/wc-multivendor-marketplace/vulnerability/wordpress-wcfm-marketplace-plugin-3-8-2-cross-site-scripting-xss-vulnerability?_s_id=cve vdb-entry