Skip to content
PluginCanary

WCFM Marketplace - Multivendor Marketplace for WooCommerce

by WC Lovers · 10,000+ active installs · Checked 3 Nov 2026
Healthy5 Warnings

Healthy: vulnerability published 17 Sep 2026, fixed in 3.8.3.

81/ 100 Canary Score
Sub-scores for WCFM Marketplace - Multivendor Marketplace for WooCommerce
Ownership100
Maintenance100
Security60
Support70
Reputation70

How the score works

Active signals

Facts we detected, with links to the source.

  • WarningSEC-1Vulnerability published 17 Sep 2026, fixed in 3.8.3. Update to version 3.8.3 or later.17 Sep 2026Evidence
  • WarningSEC-1Vulnerability published 1 Sep 2026, fixed in 3.8.2. Update to version 3.8.2 or later.1 Sep 2026Evidence
  • WarningSEC-1Vulnerability published 31 Aug 2026, fixed in 3.8.3. Update to version 3.8.3 or later.31 Aug 2026Evidence
  • WarningSEC-1Vulnerability published 26 Aug 2026, fixed in 3.8.2. Update to version 3.8.2 or later.26 Aug 2026Evidence
  • WarningSEC-1Vulnerability published 17 Aug 2026, fixed in 3.8.1. Update to version 3.8.1 or later.17 Aug 2026Evidence
  • InfoSEC-39 vulnerabilities published in the last 24 months. Review this plugin.4 Nov 2026Evidence

Ownership timeline

Who commits to the plugin's code on wordpress.org, over time.

Committers and their active periods
wclovers15 Aug 2018 to 2 Nov 2026, 351 commits

1 committer recorded. No ownership changes recorded since 3 Nov 2026.

Maintenance

Last release
2 days ago
Releases, 24 months
15
Tested up to
7.1 current
Requires PHP
7.4 supported 8.2+
Releases per quarter for WCFM Marketplace - Multivendor Marketplace for WooCommerce
Q1 20245
Q2 20242
Q3 20241
Q4 20241
Q1 20252
Q2 20250
Q3 20251
Q4 20253
Q1 20261
Q2 20263
Q3 20264
Q4 20261

Last release 2 Nov 2026. Tested with WordPress 7.1 (current).

Support

0% of 1 support threads resolved in the last 2 months.

Security record

PublishedIssueCVSSAffectedFixed inDays to patch
17 Sep 2026WCFM Marketplace <= 3.8.2 - Unauthenticated SQL Injection via 'wcfmmp_user_location_lat' / 'wcfmmp_user_location_lng' Parameter7.5<= 3.8.23.8.30
1 Sep 2026WCFM Marketplace – Multivendor Marketplace for WooCommerce <= 3.8.1 - Unauthenticated SQL Injection7.5<= 3.8.13.8.20
31 Aug 2026WCFM Marketplace – Multivendor Marketplace for WooCommerce <= 3.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4<= 3.8.23.8.30
26 Aug 2026WCFM Marketplace – Multivendor Marketplace for WooCommerce < 3.8.2 - Insecure Direct Object Reference to Unauthenticated Arbitrary Order Refund Request5.3< 3.8.23.8.20
17 Aug 2026WCFM Marketplace <= 3.8.0 - Insecure Direct Object Reference to Authenticated (Store vendor+) Cross-Vendor Review Deletion and Status Update5.4<= 3.8.03.8.10
10 Jul 2026WCFM Marketplace <= 3.7.3 - Authenticated (Vendor+) Stored Cross-Site Scripting via Attachment 'post_title'6.4<= 3.7.33.7.40
15 Apr 2026WCFM Marketplace – Multivendor Marketplace for WooCommerce <= 3.7.2 - Authenticated (Store vendor+) SQL Injection6.5<= 3.7.23.7.335
9 Feb 2026WCFM Marketplace <= 3.7.0 - Insecure Direct Object Reference to Unauthenticated Arbitrary Refund Request Creation5.3<= 3.7.03.7.10
15 Dec 2025WCFM Marketplace <= 3.7.3 - Missing Authorization4.3<= 3.7.33.7.4195
16 Sep 2024WCFM Marketplace – Multivendor Marketplace for WooCommerce <= 3.6.11 - Reflected Cross-Site Scripting6.1<= 3.6.113.6.1217
23 Nov 2023WCFM Marketplace <= 3.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode6.4<= 3.6.23.6.31
5 Apr 2023WCFM Marketplace <= 3.4.11 - Missing Authorization8.8<= 3.4.113.4.120
5 Apr 2023WCFM Marketplace <= 3.4.12 - Cross-Site Request Forgery6.3<= 3.4.123.5.00
22 Nov 2021WCFM - WooCommerce Multivendor Marketplace <= 3.4.11 - Unauthenticated SQL Injection9.8<= 3.4.113.4.120

Source: Wordfence Intelligence.

Reputation

Average rating per quarter for WCFM Marketplace - Multivendor Marketplace for WooCommerce
Q4 20235.0
Q1 20244.9
Q2 20244.2
Q3 20245.0
Q4 20245.0
Q2 20251.0
Q3 20255.0
Q1 20265.0
Q2 20265.0
Q4 20263.0

Average rating fell from 5.0 to 3.0 between Q4 2023 and Q4 2026.

Rating distribution
5 star398
4 star7
3 star3
2 star7
1 star34
Latest low reviews

Momentum

10,000+ active installs. History builds with each weekly snapshot.

Weekly downloads, last 27 weeks
Weekly downloads for WCFM Marketplace - Multivendor Marketplace for WooCommerce
4 May 2026767
11 May 20261,285
18 May 20267,938
25 May 20262,100
1 Jun 20261,330
8 Jun 20261,131
15 Jun 20261,044
22 Jun 2026954
29 Jun 20267,212
6 Jul 20262,220
13 Jul 20261,284
20 Jul 20261,087
27 Jul 20266,010
3 Aug 20262,209
10 Aug 20265,492
17 Aug 20263,337
24 Aug 20269,951
31 Aug 20264,658
7 Sep 20261,285
14 Sep 20261,646
21 Sep 20261,316
28 Sep 20261,040
5 Oct 20261,108
12 Oct 20261,141
19 Oct 20261,275
26 Oct 20261,225
2 Nov 20262,412

Weekly downloads over the last 4 weeks are 44% below the 27-week average.

Healthier alternatives

Same category, higher Canary Score. Never sponsored.

Dokan: AI Powered WooCommerce Multivendor Marketplace Solution - Build Your Own Amazon, eBay, EtsyScore 86 · 30,000+WCFM Membership - WooCommerce Memberships for Multivendor MarketplaceScore 84 · 10,000+WCFM - Frontend Manager for WooCommerceScore 83 · 20,000+MultiVendorX - WooCommerce Multivendor Marketplace AI Powered SolutionsScore 83 · 2,000+

Facts

Version3.8.4
AuthorWC Lovers
Added15 Aug 2018
Last updated2 Nov 2026
Active installs10,000+
Requires WordPress5.5
Tested up to7.1.4
Requires PHP7.4
CategoryE-commerce & Shopping
Tagsmulti vendor, ai marketplace, vendor dashboard, multivendor marketplace, woocommerce marketplace

Other plugins by this author: WCFM - Frontend Manager for WooCommerce, WCFM Membership - WooCommerce Memberships for Multivendor Marketplace, WCFM - WCFM Marketplace integrate Elementor, WCFM - Multivendor Marketplace REST API for WooCommerce, WCFM - Direct PayPal Pay for WooCommerce Multivendor Marketplace, Migrate to WooCommerce Multivendor Marketplace

Questions

Is WCFM Marketplace - Multivendor Marketplace for WooCommerce still maintained?

WCFM Marketplace - Multivendor Marketplace for WooCommerce was last updated on 2 Nov 2026. Its Canary status is Healthy.

Is WCFM Marketplace - Multivendor Marketplace for WooCommerce safe?

WCFM Marketplace - Multivendor Marketplace for WooCommerce has no open unpatched vulnerabilities on record. 9 vulnerabilities were published in the last 24 months. Its Canary status is Healthy.

Who owns WCFM Marketplace - Multivendor Marketplace for WooCommerce?

The wordpress.org author is WC Lovers. Recent committers: wclovers, plugin-master. We have recorded no ownership change.

What can I use instead of WCFM Marketplace - Multivendor Marketplace for WooCommerce?

Plugins in the same category with a higher Canary Score: Dokan: AI Powered WooCommerce Multivendor Marketplace Solution - Build Your Own Amazon, eBay, Etsy, WCFM Membership - WooCommerce Memberships for Multivendor Marketplace, WCFM - Frontend Manager for WooCommerce, MultiVendorX - WooCommerce Multivendor Marketplace AI Powered Solutions.

Data: wordpress.org Plugins API, plugins SVN and Trac, wordpress.org reviews, Wordfence Intelligence.Plugin data refreshed 3 Nov 2026.Report a data issue