Description

Contributor Cross Site Scripting (XSS) in WCFM Marketplace <= 3.8.2 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-09-02T12:17:13.780Z",
  "pubdate": "2026-09-02T12:17:13.780Z",
  "executiveSummary": "A Cross-Site Scripting (XSS) vulnerability exists in WCFM Marketplace versions 3.8.2 and below, allowing authenticated users with contributor-level privileges to inject malicious scripts into the application.\nThe vulnerability is classified as a Stored XSS flaw, occurring when user-supplied input is inadequately sanitized before being processed and stored in the database.\nSuccessful exploitation enables an attacker to execute arbitrary JavaScript within the context of a victim's browser session. This can lead to unauthorized actions, such as session hijacking, defacement, or the exfiltration of sensitive session cookies and administrative credentials.\nThe scope of impact is limited to the web application's administrative or vendor dashboard where the injected payload is rendered. Exploitation requires authenticated access to the contributor account, making this a vertical privilege escalation risk if the payload targets higher-privileged users like site administrators.",
  "technicalDetails": "The vulnerability resides within the input processing logic of the WCFM Marketplace plugin, which fails to properly validate and sanitize data submitted by users assigned the contributor role. The root cause is the improper handling of user-controlled fields during the submission or editing of marketplace-related content, such as product descriptions or profile settings.\nIn a Stored XSS attack flow, the malicious actor initiates the process by logging into the platform using a low-privileged contributor account. The attacker then injects a crafted payload—typically encapsulated within HTML tags such as <script>, <img>, or <iframe>—into vulnerable input fields that accept unsanitized text. Once saved, this input is written directly to the underlying database.\nThe malicious script remains dormant until a legitimate user, such as an administrator or a vendor, views the affected component via their dashboard. At this stage, the web application retrieves the contaminated record from the database and embeds the raw, unescaped malicious JavaScript directly into the rendered HTML page. When the victim's browser parses the document, it executes the payload under the origin of the WCFM Marketplace application.\nBecause the payload executes within the context of the victim's authenticated session, the attacker gains the ability to perform actions on behalf of the victim. This includes modifying system configurations, creating new administrative accounts, or accessing sensitive merchant data. Furthermore, the attacker can use XMLHttpRequest or fetch APIs to exfiltrate session identifiers (such as session tokens or non-HttpOnly cookies) to an external attacker-controlled server.\nThe lack of server-side output encoding ensures that the payload is rendered globally whenever the specific view is accessed. The vulnerability is persistent, meaning the attack does not require repeated interaction with the contributor; it will trigger every time the targeted administrative page is loaded until the record is manually purged from the database or the underlying code is patched to enforce strict context-aware encoding."
}