CVE Tools
Track your stack

Wclovers

7 CVEs tracked since 2023. Since Apr 2023, none of them reached CISA KEV.

Wclovers CVEs per month

Apr 2023 to Oct 2026. Point at a month, or focus the strip and use the arrow keys.
Wclovers CVEs per month, with the share now in CISA KEV
MonthCVEsIn CISA KEV
2023-0470
2023-053 or fewer
2023-064 or fewer
2023-073 or fewer
2023-084 or fewer
2023-093 or fewer
2023-104 or fewer
2023-114 or fewer
2023-124 or fewer
2024-014 or fewer
2024-024 or fewer
2024-034 or fewer
2024-044 or fewer
2024-055 or fewer
2024-064 or fewer
2024-074 or fewer
2024-084 or fewer
2024-093 or fewer
2024-104 or fewer
2024-114 or fewer
2024-123 or fewer
2025-014 or fewer
2025-023 or fewer
2025-035 or fewer
2025-044 or fewer
2025-054 or fewer
2025-064 or fewer
2025-075 or fewer
2025-084 or fewer
2025-094 or fewer
2025-104 or fewer
2025-114 or fewer
2025-125 or fewer
2026-015 or fewer
2026-025 or fewer
2026-037 or fewer
2026-046 or fewer
2026-057 or fewer
2026-067 or fewer
2026-077 or fewer
2026-088 or fewer
2026-099 or fewer
2026-106 or fewer

Products

The products that kept showing up in Wclovers's monthly top three, with their CVEs summed over those months.

  1. Wcfm Membership31 month
  2. Wcfm Membership – Woocommerce Memberships For Multivendor Marketplace31 month
  3. Frontend Manager For Woocommerce Along With Bookings Subscription Listings Compatible21 month

Latest CVEs

The 15 most recently published vulnerabilities affecting Wclovers.

  1. CVE-2026-18442WCFM Marketplace <= 3.8.2 - Unauthenticated SQL Injection via 'wcfmmp_user_location_lat' / 'wcfmmp_user_location_lng' Parameter7.5
  2. CVE-2026-10041WCFM – Frontend Manager for WooCommerce <= 6.7.27 - Authenticated (Subscriber+) Missing Authorization to Arbitrary Vendor Data Manipulation via Multiple AJAX Handlers4.3
  3. CVE-2026-12994WCFM – Frontend Manager for WooCommerce <= 6.7.27 - Missing Authorization to Unauthenticated Arbitrary Inquiry Reply Injection via wcfm-my-account-enquiry-manage Controller5.3
  4. CVE-2026-12126WCFM Marketplace <= 3.7.3 - Authenticated (Vendor+) Stored Cross-Site Scripting via Attachment 'post_title'6.4
  5. CVE-2026-3688WCFM - WooCommerce Multivendor Membership <= 2.11.10 - Insecure Direct Object Reference to Limited Privilege Escalation via User Role Overwrite8.1
  6. CVE-2026-2554WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible <= 6.7.25 - Authenticated (Vendor+) Insecure Direct Object Reference to Arbitrary User Deletion8.1
  7. CVE-2026-4896WCFM - WooCommerce Frontend Manager <= 6.7.25 - Insecure Direct Object References to Autenticated (Vendor+) Arbitrary Post/Product Manipulation8.1
  8. CVE-2026-1722WCFM Marketplace <= 3.7.0 - Insecure Direct Object Reference to Unauthenticated Arbitrary Refund Request Creation5.3
  9. CVE-2025-15147WCFM Membership – WooCommerce Memberships for Multivendor Marketplace <= 2.11.8 - Insecure Direct Object Reference to Update Membership Payment4.3
  10. CVE-2026-0845WCFM - WooCommerce Frontend Manager <= 6.7.24 - Authenticated (Shop Manager+) Arbitrary Options Update7.2
  11. CVE-2025-3780WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible <= 6.7.16 - Missing Authorization to Unauthenticated Plugin Settings Modification6.5
  12. CVE-2025-1311WooCommerce Multivendor Marketplace – REST API <= 1.6.2 - Authenticated (Subscriber+) SQL Injection6.5
  13. CVE-2024-8290WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible <= 6.7.12 - Insecure Direct Object Reference to Account Takeover/Privilege Escalation8.8
  14. CVE-2024-44009WordPress WCFM Marketplace <= 3.6.11 - Reflected Cross Site Scripting (XSS) vulnerability7.1
  15. CVE-2023-4960WCFM Marketplace <= 3.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode6.4

The record

Peak rank
#97 in Apr 2023
Busiest month shown
Apr 2023, 7 CVEs
Months with a KEV entry
0 since Apr 2023
Monthly snapshots
1 since 2023
Wclovers's full record, month by month