PT-2026-57412 · WordPress · Wcfm Marketplace

Nadir Şensoy

·

Published

2026-07-11

·

Updated

2026-07-11

·

CVE-2026-12126

CVSS v3.1

6.4

Medium

VectorAV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Name of the Vulnerable Software and Affected Versions WCFM Marketplace – Multivendor Marketplace for WooCommerce versions prior to 3.7.4
Description Insufficient input sanitization and output escaping allow authenticated attackers with Vendor-level access or higher to perform Stored Cross-Site Scripting. An attacker can inject arbitrary web scripts by uploading a media attachment with a crafted post title via the WordPress REST API endpoint '/wp-json/wp/v2/media'. The unescaped title is subsequently emitted within DataTables JSON and inserted as innerHTML when a privileged user loads the media dashboard, causing the script to execute in the user's browser.
Recommendations Update WCFM Marketplace – Multivendor Marketplace for WooCommerce to version 3.7.4 or later.

Fix

XSS

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-12126

Affected Products

Wcfm Marketplace