Stored Cross-Site Scripting in WCFM Marketplace Plugin for WordPress
CVE-2023-4960

5.4MEDIUM

Key Information:

Vendor: Wordpress
Status: WCFM Marketplace – Best Multivendor Marketplace for WooCommerce
Vendor: CVE Published:; 11 January 2024

Summary

The WCFM Marketplace plugin for WordPress contains a Stored Cross-Site Scripting vulnerability linked to the 'wcfm_stores' shortcode. This issue arises from inadequate sanitization and escaping of user-supplied data, allowing attackers with contributor-level permissions or higher to embed malicious web scripts. These scripts are executed in the browsers of users visiting the manipulated pages, posing serious security risks for both site administrators and users. Prompt action is required to mitigate these risks by updating to the latest plugin version.

Affected Version(s)

WCFM Marketplace – Best Multivendor Marketplace for WooCommerce * <= 3.6.2

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...

https://plugins.trac.wordpress.org/browser/wc-multivendor...

CVSS V3.1

Score:

5.4

Severity:

MEDIUM

Confidentiality:

Low

Integrity:

Low

Availability:

Low

Attack Vector:

Network

Attack Complexity:

Low

Privileges Required:

Low

User Interaction:

Required

Scope:

Changed

Timeline

Vulnerability published
Jan 11, 2024
Vulnerability Reserved
Sep 14, 2023

Credit

István Márton