Unknown Wcfm Marketplace vulnerabilities

2 CVEs affecting Unknown Wcfm Marketplace, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-77701, published 2026-08-28.

More from Unknown.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2026-77701, published 2026-08-28. Medium severity, CVSS 5.3. EPSS: 0.3% chance of exploitation in the next 30 days. The WCFM Marketplace WordPress plugin before 3.8.2 does not correctly verify that the person requesting a refund owns the order, allowing unauthenticated users to create refund requests against any…
• CVE-2026-14196, published 2026-08-19. Medium severity, CVSS 4.3. EPSS: 0.3% chance of exploitation in the next 30 days. The WCFM Marketplace WordPress plugin before 3.8.1 does not verify that a marketplace vendor owns a review before allowing it to be unapproved or deleted, allowing any vendor to modify or…