Vendor

    WC Lovers

    26 known vulnerabilities in products by WC Lovers, 0 of them actively exploited (CISA KEV).

    Key figures

    26

    Vulnerabilities

    0

    Actively exploited (KEV)

    0

    Used by ransomware

    3

    Critical

    Vulnerabilities

    Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.

    Vulnerabilities in WC Lovers
    CriticalCVE-2021-24849

    WCFM - WooCommerce Multivendor Marketplace < 3.4.12 - Unauthenticated SQL Injection

    		9.8
    CriticalCVE-2022-4939

    WCFM Membership <= 2.10.0 - Unauthenticated Privilege Escalation

    		9.8
    CriticalCVE-2023-2276

    Wclovers Wcfm Membership: Authorization Bypass Through User-Controlled Key

    		9.8
    HighCVE-2026-18442

    Wclovers WCFM Marketplace: SQL Injection

    		7.5
    HighCVE-2021-24835

    WCFM - Frontend Manager for WooCommerce < 6.5.12 - Customer/Subscriber+ SQL Injection

    		8.8
    HighCVE-2022-4940

    WCFM Membership <= 2.10.0 - Missing Authorization

    		7.3
    HighCVE-2022-4935

    WCFM Marketplace <= 3.4.11 - Missing Authorization

    		8.8
    HighCVE-2026-3688

    Authorization Bypass Through User-Controlled Key (CVE-2026-3688)

    		8.1
    HighCVE-2024-8290

    Wclovers WCFM: Authorization Bypass Through User-Controlled Key

    		8.8
    MediumCVE-2026-12994

    Wclovers WCFM: Missing Authorization

    		5.3
    HighCVE-2026-0845

    Wclovers WCFM: Missing Authorization

    		7.2
    HighCVE-2026-4896

    Wclovers WCFM: Authorization Bypass Through User-Controlled Key

    		8.1
    HighCVE-2026-2554

    Wclovers WCFM: Authorization Bypass Through User-Controlled Key

    		8.1
    MediumCVE-2026-12126

    Wclovers WCFM Marketplace: Cross-site Scripting

    		6.4
    HighCVE-2022-4937

    WCFM – Frontend Manager for WooCommerce: security vulnerability

    		6.3
    MediumCVE-2026-10041

    Wclovers WCFM: Authorization Bypass Through User-Controlled Key

    		4.3
    MediumCVE-2025-1311

    WooCommerce Multivendor Marketplace – REST API <= 1.6.2 - Authenticated (Subscriber+) SQL Injection

    		6.5
    MediumCVE-2023-4960

    WCFM Marketplace <= 3.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

    		6.4
    HighCVE-2024-44009

    WordPress WCFM Marketplace <= 3.6.11 - Reflected Cross Site Scripting (XSS) vulnerability

    also in 1 other product

    		7.1
    MediumCVE-2025-3780

    Wclovers WCFM: Missing Authorization

    		6.5
    MediumCVE-2026-1722

    Wclovers WCFM Marketplace: Missing Authorization

    		5.3
    HighCVE-2022-4941

    WCFM Membership <= 2.9.10 - Cross-Site Request Forgery

    		6.3
    MediumCVE-2025-15147

    Authorization Bypass Through User-Controlled Key (CVE-2025-15147)

    		4.3
    MediumCVE-2023-2275

    Wclovers WCFM: Missing Authorization

    		4.3
    HighCVE-2022-4938

    WCFM Frontend Manager <= 6.5.13 - Cross-Site Request Forgery

    		6.3

    All vulnerabilities in search

    Products

    Products by WC Lovers
    Wcfm – Frontend Manager For Woocommerce80
    WCFM60
    Wcfm Marketplace – Multivendor Marketplace For Woocommerce60
    Wcfm Membership – Woocommerce Memberships For Multivendor Marketplace60
    WCFM Marketplace40
    WCFM Membership40