CVE-2026-61987: WordPress WCFM – Frontend Manager for WooCommerce plugin <= 6.8.1 - Cross Site Scripting (XSS) vulnerability

Q: What access and interaction are required to exploit this issue?

The CVSS vector indicates that an attacker needs low-level privileges and that a user must interact with attacker-controlled content. The attack can be performed over the network with low attack complexity.

Q: Which installations are affected?

WCFM – Frontend Manager for WooCommerce versions through 6.8.1 are affected. The provided information does not identify a fixed version or state whether any particular WordPress configuration avoids exposure.

Q: What is the potential impact of successful exploitation?

This is a stored XSS issue, meaning injected script may be retained and later executed when a user views the affected content. The supplied CVSS assessment rates confidentiality, integrity, and availability impact as low, with scope changed.

Published Nov 8, 2026

Updated

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WC Lovers WCFM – Frontend Manager for WooCommerce wc-frontend-manager allows Stored XSS.This issue affects WCFM – Frontend Manager for WooCommerce: from n/a through 6.8.1.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade WC Lovers WCFM – Frontend Manager for WooCommerce to a version that resolves this vulnerability.
Fixed in 6.8.2

Event History

Nov 8, 2026

CVE Published

via MITRE·04:00 PM

Data Sourced

via MITRE·04:00 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·04:16 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What access and interaction are required to exploit this issue?

The CVSS vector indicates that an attacker needs low-level privileges and that a user must interact with attacker-controlled content. The attack can be performed over the network with low attack complexity.

Which installations are affected?

WCFM – Frontend Manager for WooCommerce versions through 6.8.1 are affected. The provided information does not identify a fixed version or state whether any particular WordPress configuration avoids exposure.

What is the potential impact of successful exploitation?

This is a stored XSS issue, meaning injected script may be retained and later executed when a user views the affected content. The supplied CVSS assessment rates confidentiality, integrity, and availability impact as low, with scope changed.

CVE-2026-61987: WordPress WCFM – Frontend Manager for WooCommerce plugin <= 6.8.1 - Cross Site Scripting (XSS) vulnerability

Remediation

Event History

Frequently Asked Questions

What access and interaction are required to exploit this issue?

Which installations are affected?

What is the potential impact of successful exploitation?

Company

Resources

Contact

Frequently Asked Questions

What access and interaction are required to exploit this issue?

Which installations are affected?

What is the potential impact of successful exploitation?