CVE-2026-120848

Name of the Vulnerable Software and Affected Versions WCFM Marketplace versions prior to 3.8.4

Description The WCFM Marketplace plugin for WordPress contains a Stored Cross-Site Scripting (XSS) flaw, which occurs when an application includes untrusted data in a web page without proper validation or escaping. This issue stems from insufficient input sanitization and output escaping, allowing authenticated attackers with vendor-level access or higher to inject arbitrary web scripts into pages. These scripts execute automatically when any user visits the affected page.

Recommendations Update to a version newer than 3.8.3.