PLUGIN SECURITY
Is Wc Frontend Manager safe?
Professional frontend dashboard for WooCommerce and multivendor marketplaces. Supports WCFM Marketplace, Dokan, WC Vendors, WC Product Vendors.
What this plugin does
- Slug:
wc-frontend-manager - Author: WC Lovers
- 20000+ active installs
- 90/100 rating (286 reviews on wordpress.org)
- 1779626 all-time downloads
- On WordPress.org since 2017-03-19
multi vendormultivendor marketplaceproduct vendorswoocommerce marketplacewp user frontend
Maintenance status
- Last updated: 2026-11-02 8:35am GMT
- Tested up to WordPress: 7.1.4
- Requires PHP: 7.4+
- Max supported PHP (analyzed): 8.4
Known vulnerabilities
10 known CVEs on file for Wc Frontend Manager.
| CVE | Vulnerability | Type | Severity | Affected | Fixed in | Published | Status |
|---|---|---|---|---|---|---|---|
| CVE-2026-10041 | WCFM – Frontend Manager for WooCommerce [wc-frontend-manager] < 6.7.28 | Authorization Bypass Through User-Controlled Key | Medium 4.3 | < 6.7.28 | 6.7.28 | 2026-07-10 | — |
| CVE-2026-12994 | WCFM – Frontend Manager for WooCommerce [wc-frontend-manager] < 6.7.28 | Missing Authorization | Medium 5.3 | < 6.7.28 | 6.7.28 | 2026-07-10 | — |
| CVE-2026-61987 | WCFM – Frontend Manager for WooCommerce [wc-frontend-manager] < 6.8.2 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.5 | < 6.8.2 | 6.8.2 | 2026-07-10 | — |
| CVE-2026-2554 | WCFM – Frontend Manager for WooCommerce [wc-frontend-manager] < 6.7.26 | Authorization Bypass Through User-Controlled Key | High 8.1 | < 6.7.26 | 6.7.26 | 2026-05-01 | — |
| CVE-2025-54004 | WCFM – Frontend Manager for WooCommerce [wc-frontend-manager] < 6.7.25 | Missing Authorization | Low 2.7 | < 6.7.25 | 6.7.25 | 2025-12-15 | — |
| CVE-2024-8290 | WCFM – Frontend Manager for WooCommerce [wc-frontend-manager] < 6.7.13 | Authorization Bypass Through User-Controlled Key | High 8.8 | < 6.7.13 | 6.7.13 | 2024-09-24 | — |
| CVE-2024-29929 | WCFM – Frontend Manager for WooCommerce [wc-frontend-manager] < 6.7.9 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 5.9 | < 6.7.9 | 6.7.9 | 2024-03-25 | — |
| CVE-2022-4938 | WCFM – Frontend Manager for WooCommerce [wc-frontend-manager] < 6.6.0 | Cross-Site Request Forgery (CSRF) | High 8.8 | < 6.6.0 | 6.6.0 | 2023-04-05 | — |
+ 6 more known vulnerabilities
| CVE | Vulnerability | Type | Severity | Affected | Fixed in | Published | Status |
|---|---|---|---|---|---|---|---|
| CVE-2022-4937 | WCFM – Frontend Manager for WooCommerce [wc-frontend-manager] < 6.6.1 | Missing Authorization | High 8.8 | < 6.6.1 | 6.6.1 | 2023-04-05 | — |
| — | WCFM – Frontend Manager for WooCommerce [wc-frontend-manager] < 6.6.2 | — | Unknown | < 6.6.2 | 6.6.2 | 2022-02-19 | — |
| CVE-2021-24835 | WCFM – Frontend Manager for WooCommerce [wc-frontend-manager] < 6.5.12 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | High 8.8 | < 6.5.12 | 6.5.12 | 2021-10-11 | — |
| — | WCFM – Frontend Manager for WooCommerce [wc-frontend-manager] < 6.7.17 | Missing Authorization | Medium 6.5 | < 6.7.17 | 6.7.17 | 0000-00-00 | — |
| — | WCFM – Frontend Manager for WooCommerce [wc-frontend-manager] < 6.7.26 | — | Unknown | < 6.7.26 | 6.7.26 | 0000-00-00 | — |
| — | WCFM – Frontend Manager for WooCommerce [wc-frontend-manager] < 6.7.25 | — | Unknown | < 6.7.25 | 6.7.25 | 0000-00-00 | — |
How to fix it
Update this plugin to the latest release from wordpress.org — each CVE above lists the exact release that fixed it ("Fixed in") when one is on file.
This is the plugin's full known vulnerability history, not a scan of any specific installation — run a free scan of your own site to check your exact installed version.
Safer / more established alternatives
- Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy — 30000+ active installs — 92/100 (769) — max PHP <8.0
- WCFM Marketplace – Multivendor Marketplace for WooCommerce — 10000+ active installs — 92/100 (449) — max PHP 8.4
- WCFM Membership – WooCommerce Memberships for Multivendor Marketplace — 10000+ active installs — 80/100 (25) — max PHP 8.4
- WC Vendors – WooCommerce Multivendor, WooCommerce Marketplace, Product Vendors — 3000+ active installs — 90/100 (188)
- MultiVendorX – WooCommerce Multivendor Marketplace AI Powered Solutions — 2000+ active installs — 96/100 (432)
Check your own WordPress site
Run a free passive scan now, or create a free account and install the WP Clinic plugin for a deep scan of your whole hosting account and AI-assisted repair.