Description
Contributor Cross Site Scripting (XSS) in WCFM Marketplace <= 3.8.2 versions.
Published: 2026-09-02
Score: 6.5 Medium
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The WCFM Marketplace plugin contains a contributor‑level Cross‑Site Scripting flaw that allows an attacker to inject malicious scripts into pages viewed by other users. This weakness, categorized as CWE‑79, can lead to compromised user sessions, defacement, or theft of sensitive information without requiring elevated privileges.

Affected Systems

The vulnerability affects the WordPress WCFM Marketplace plugin from the vendor WC Lovers, specifically all releases up to and including version 3.8.2. Users running these or earlier versions are exposed.

Risk and Exploitability

The CVSS score of 6.5 indicates a moderate impact. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog. The flaw is exploitable from a web interface that accepts contributor input; therefore, any active contributor with access to the plugin’s input fields can trigger the XSS attack.

Generated by OpenCVE AI on September 2, 2026 at 12:23 UTC.

Remediation

Vendor Solution

Update the WordPress WCFM Marketplace plugin to the latest available version (at least 3.8.3).

OpenCVE Recommended Actions

  • Update the WordPress WCFM Marketplace plugin to version 3.8.3 or later
  • If an immediate upgrade is not feasible, remove the Contributor role or restrict contributors from accessing the vulnerable areas of the plugin
  • Add additional client‑side sanitization or a content‑security‑policy to mitigate the effect of any remaining injected scripts

Generated by OpenCVE AI on September 2, 2026 at 12:23 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 02 Sep 2026 13:15:00 +0000

Type Values Removed Values Added
First Time appeared Wclovers
Wclovers wcfm Marketplace
Wordpress
Wordpress wordpress
Vendors & Products Wclovers
Wclovers wcfm Marketplace
Wordpress
Wordpress wordpress

Wed, 02 Sep 2026 11:45:00 +0000

Type Values Removed Values Added
Description Contributor Cross Site Scripting (XSS) in WCFM Marketplace <= 3.8.2 versions.
Title WordPress WCFM Marketplace plugin <= 3.8.2 - Cross Site Scripting (XSS) vulnerability
Weaknesses CWE-79
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L'}

Subscriptions

Wclovers Wcfm Marketplace
Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: Patchstack

Published:

Updated: 2026-09-02T13:04:21.566Z

Reserved: 2026-08-31T19:02:41.465Z

Link: CVE-2026-83562

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Deferred

Published: 2026-09-02T12:17:13.780

Modified: 2026-09-02T13:54:48.797

Link: CVE-2026-83562

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-02T13:00:11Z

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')