CVE-2026-18442

HighCVSS 7.5/10Last modified Sep 19, 2026

Description

The WCFM Marketplace – Multivendor Marketplace for WooCommerce plugin for WordPress is vulnerable to generic SQL Injection via the 'wcfmmp_user_location_lng' parameter in all versions up to, and including, 3.8.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
wclovers	WCFM Marketplace – Multivendor Marketplace for WooCommerce	<= 3.8.2

References

Timeline

Published: Sep 18, 2026
Last modified: Sep 19, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-184438.8The Smart Manager – Advanced WooCommerce Bulk Edit & Inventory Management plugin for WordPress is vulnerable to generic SQL Injection via th CVE-2026-184447.8There is an integer conversion vulnerability resulting in an out-of-bounds read when loading images recently discovered in NI LabVIEW. This CVE-2026-184457.8There is an integer overflow vulnerability resulting in an out-of-bounds write recently discovered in NI LabVIEW. This may result in inform CVE-2026-184467.5fast-uri before 4.1.2, 3.1.5, and 2.4.4 requires a literal double forward slash to recognize a URI authority, so a reference that uses a bac CVE-2026-184478.8Type confusion in PostgreSQL SQL-language functions allows an object creator to execute arbitrary code as the operating system user running CVE-2026-184485.6EDK2 contains a vulnerability in BIOS where a privileged attacker may cause “Exposure of Sensitive Information during Transient Execution” b CVE-2026-184497.5The BMC does not correctly enforce integrity and encryption requirements for IPMI commands. An attacker may be able to craft packets that ex CVE-2026-18455.5The Real Estate Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and includin CVE-2026-184509.8The BMC does not correctly enforce integrity and encryption requirements for IPMI commands. An attacker may be able to craft packets that ex CVE-2026-184513.1The HTML5 KVM-over-IP console authenticates with a token returned by the web interface. Weaknesses in token generation may allow an attacker CVE-2026-1845210.0DMS+ (Non-Mobile) developed by Rich Source has a Use of Hard-coded Credentials vulnerability. Unauthenticated remote attackers can exploit a CVE-2026-184537.5A flaw was found in 389 Directory Server. A missing NULL pointer check in the paged results handling of op_shared_search allows an unauthent