Technical impact
The vulnerability is a stored Cross‑Site Scripting flaw that allows an authenticated attacker with Vendor‑level or higher privileges to inject arbitrary JavaScript into the media dashboard through the attachment 'post_title' field. The unescaped title is later emitted inside DataTables JSON and inserted as innerHTML when a privileged user loads the media dashboard, causing the injected script to execute in the victim’s browser. This can lead to session hijacking, defacement, or phishing attempts against other privileged users. The weakness falls under CWE‑79, identifying insufficient output escaping.
Affected Systems
All installations of the WCFM Marketplace – Multivendor Marketplace for WooCommerce plugin with version numbers up to and including 3.7.3 are affected. The plugin, maintained by wclovers, is commonly used in WordPress sites that enable vendors to upload media. Any site that has permitted vendor‑level or higher roles to upload attachments via the WordPress REST API (/wp-json/wp/v2/media) is at risk.
Risk and Exploitability
The CVSS score of 6.4 indicates moderate severity, while the EPSS score of less than 1% suggests a relatively low probability of exploitation at the current time. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires valid credentials and Vendor or higher role access, and the attack vector is inferred to be the REST API used for media uploads: a crafted attachment title will execute for any other privileged user who accesses the media dashboard, providing a straightforward client‑side attack path for authenticated attackers.
