CVE-2026-61987mediumCWE-79

CVE-2026-61987: medium-severity vulnerability in WCFM – Frontend Manager for WooCommerce

WordPress WCFM – Frontend Manager for WooCommerce plugin <= 6.8.1 - Cross Site Scripting (XSS) vulnerability

Published

Follow this CVE+ Monitor WCFM – Frontend Manager for WooCommerce

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

10Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WC Lovers WCFM – Frontend Manager for WooCommerce wc-frontend-manager allows Stored XSS.This issue affects WCFM – Frontend Manager for WooCommerce: from n/a through 6.8.1.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
Affected products
WC Lovers · WCFM – Frontend Manager for WooCommerce
Related CVEs — WCFM – Frontend Manager for WooCommerce

In the same product, most dangerous first.

CVE-2024-29929MEDIUMWordPress WCFM plugin <= 6.7.8 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2025-54004LOWWordPress WCFM – Frontend Manager for WooCommerce plugin <= 6.7.24 - Broken Access Control vulnerabilityEPSS 0.3%