Stored Cross-Site Scripting in WCFM Marketplace Plugin for WordPress
CVE-2023-4960
5.4MEDIUM
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 11 January 2024
What is CVE-2023-4960?
The WCFM Marketplace plugin for WordPress contains a Stored Cross-Site Scripting vulnerability linked to the 'wcfm_stores' shortcode. This issue arises from inadequate sanitization and escaping of user-supplied data, allowing attackers with contributor-level permissions or higher to embed malicious web scripts. These scripts are executed in the browsers of users visiting the manipulated pages, posing serious security risks for both site administrators and users. Prompt action is required to mitigate these risks by updating to the latest plugin version.
Affected Version(s)
WCFM Marketplace – Best Multivendor Marketplace for WooCommerce * <= 3.6.2