https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2025-3780.htmlhttps://patchthecve.com/cve/CVE-2025-3780.htmlWed, 17 Jun 2026 09:20:39 +0000MEDIUM 6.5: The WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wcfm_redirect_to_setup function in all versions up to, and including, 6.7.16. This makes ihttps://patchthecve.com/cve/CVE-2024-8290.htmlhttps://patchthecve.com/cve/CVE-2024-8290.htmlWed, 17 Jun 2026 08:22:17 +0000HIGH 8.8: The WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.7.12 via the WCFM_Customers_Manage_Controller::processing function due to missing validationhttps://patchthecve.com/cve/CVE-2024-44009.htmlhttps://patchthecve.com/cve/CVE-2024-44009.htmlWed, 17 Jun 2026 07:52:09 +0000HIGH 7.1: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WC Lovers WCFM Marketplace wc-multivendor-marketplace allows Reflected XSS.This issue affects WCFM Marketplace: from n/a through <= 3.6.11.https://patchthecve.com/cve/CVE-2023-4960.htmlhttps://patchthecve.com/cve/CVE-2023-4960.htmlWed, 17 Jun 2026 06:38:58 +0000MEDIUM 6.4: The WCFM Marketplace plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'wcfm_stores' shortcode in versions up to, and including, 3.6.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with c