{"id":"CVE-2026-120848","kind":"vulnerability","aliases":["CVE-2026-120848"],"related":[],"title":"WCFM Marketplace WordPress plugin: stored XSS through input handling","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WC Lovers WCFM Marketplace wc-multivendor-marketplace allows Stored XSS.This issue affects WCFM Marketplace: from n/a through 3.8.3.","summary":"WCFM Marketplace, a WordPress multivendor plugin, fails to neutralize input before generating web pages, allowing stored cross-site scripting. An attacker can plant script that runs in the browsers of other users who view the affected page.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","wcfm-marketplace","woocommerce","wordpress"],"not_affected_if":["patched-version","plugin-not-installed"],"how_to_check":"- Check the installed version of the wc-multivendor-marketplace plugin in the WordPress admin plugin list\n- Confirm whether the installed version is `3.8.3` or earlier, which the sources list as affected","fix":null,"status":"open","published_at":"2026-11-07T09:17:13+00:00","first_seen_at":"2026-11-07T09:46:24+00:00","triaged_at":"2026-11-07T09:47:52+00:00","updated_at":"2026-11-07T09:47:52+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-11-07T09:47:52Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"WCFM Marketplace WordPress plugin: stored XSS through input handling","impact":"medium","summary":"WCFM Marketplace, a WordPress multivendor plugin, fails to neutralize input before generating web pages, allowing stored cross-site scripting. An attacker can plant script that runs in the browsers of other users who view the affected page.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","woocommerce","wcfm-marketplace","self-hosted"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"script runs in other users' browsers, session data exposed","analyst_note":"Sources give only the affected range through 3.8.3; check the NVD entry or the WordPress plugin changelog for the fixed version and the privilege level needed to inject stored content.","how_to_check":"- Check the installed version of the wc-multivendor-marketplace plugin in the WordPress admin plugin list\n- Confirm whether the installed version is `3.8.3` or earlier, which the sources list as affected","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed","patched-version"],"who_is_affected":"WordPress sites running the WCFM Marketplace plugin (wc-multivendor-marketplace) at version 3.8.3 or earlier are affected. Stores where only trusted administrators can enter content are at lower risk, but vendors and shoppers viewing stored content are the exposed audience. Sites without this plugin can skip it.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000717,"input_tokens":4236,"output_tokens":586,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-120848':12A,15A '-2026':11A,14A '3.8.3':95C 'affect':61B,89C 'allow':39B,85C 'attack':46B 'browser':54B 'cross':42B,72C 'cross-sit':41B,71C 'cve':10A,13A 'fail':31B 'generat':36B,70C 'handl':9A 'host':19B 'improp':63C 'input':8A,34B,66C 'issu':88C 'lover':78C 'marketplac':2A,22B,26B,80C,84C,91C 'multivendor':29B,83C 'n/a':93C 'neutral':33B,64C 'packag':16B 'page':38B,62B,69C 'plant':48B 'plugin':4A,30B 'run':51B 'script':44B,49B,74C 'self':18B 'self-host':17B 'site':43B,73C 'store':5A,40B,86C 'user':57B 'view':59B 'vulner':75C 'wc':77C,82C 'wc-multivendor-marketplac':81C 'wcfm':1A,21B,25B,79C,90C 'wcfm-marketplac':20B 'web':37B,68C 'woocommerc':23B 'wordpress':3A,24B,28B 'xss':6A 'xss.this':87C","nicknames":[],"mitigations":[],"who_affected":"WordPress sites running the WCFM Marketplace plugin (wc-multivendor-marketplace) at version 3.8.3 or earlier are affected. Stores where only trusted administrators can enter content are at lower risk, but vendors and shoppers viewing stored content are the exposed audience. Sites without this plugin can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","package","selfhosted","wcfmmarketplace","woocommerce","wordpress"],"campaign_type":null,"search_a":"'-120848':12A,15A '-2026':11A,14A 'cve':10A,13A 'handl':9A 'input':8A 'marketplac':2A 'plugin':4A 'store':5A 'wcfm':1A 'wordpress':3A 'xss':6A","search_b":"'affect':61B 'allow':39B 'attack':46B 'browser':54B 'cross':42B 'cross-sit':41B 'fail':31B 'generat':36B 'host':19B 'input':34B 'marketplac':22B,26B 'multivendor':29B 'neutral':33B 'packag':16B 'page':38B,62B 'plant':48B 'plugin':30B 'run':51B 'script':44B,49B 'self':18B 'self-host':17B 'site':43B 'store':40B 'user':57B 'view':59B 'wcfm':21B,25B 'wcfm-marketplac':20B 'web':37B 'woocommerc':23B 'wordpress':24B,28B","search_c":"'3.8.3':95C 'affect':89C 'allow':85C 'cross':72C 'cross-sit':71C 'generat':70C 'improp':63C 'input':66C 'issu':88C 'lover':78C 'marketplac':80C,84C,91C 'multivendor':83C 'n/a':93C 'neutral':64C 'page':69C 'script':74C 'site':73C 'store':86C 'vulner':75C 'wc':77C,82C 'wc-multivendor-marketplac':81C 'wcfm':79C,90C 'web':68C 'xss.this':87C","first_public_at":"2026-11-07T09:17:13+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120848","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120848","severity":null,"published_at":"2026-11-07T09:17:13+00:00","modified_at":"2026-11-07T09:17:13+00:00","first_seen_at":"2026-11-07T09:46:24+00:00","fetched_at":"2026-11-07T09:46:24+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}