WCFM – Frontend Manager for WooCommerce

How well this listing is tuned to rank in WordPress.org search, on the factors an owner controls. Not popularity, optimization.

Directory rank vs rivals

wp.org popularity rank over time · higher is better · when a rival's line climbs above yours, they've overtaken you

How often this plugin actually ships. A steady rhythm is the maintenance signal a single "last updated" date can't show.

Share of active installs on each version of this plugin. Green is the current release; a big slice on older versions is a user base that has stopped updating.

Refined from the date this plugin crossed into its current band.

No paid tier is visible, so we don't put a figure on revenue or sale value: that would be guessing. The install base is a real asset to an acquirer, just not one public data lets us price.

1. ★★★★★ tiph83210

   4mo ago

   RIEN NE FONCTIONNE, le plus in affiliation ne fonctionne pas la carte cadeau et les bons de réductions ne fonctionnent pas l’affiche de la map ne fonctionne pas cela fait 3 mois que j’attends des nouvelles de votre part et aucune réponse ! Le support ne répond pas, le plug in est buggé de partout. De nombreuses erreurs dans le code, la traduction casse les modules. Depuis que je l’ai installé sur mon site tout est cassé. Aucune mise à jours des plus ins payants This topic was modified 2 months, 2 weeks ago by tiph83210.

   Read on wp.org ↗
2. ★★★★★ ohundred

   11mo ago

   The WCFM marketplace is a very big, complex, and overall great plugin. It takes sometime and effort to make it all work with your existing structure, but will be well worth it. I appreciate it being actively updated as well, you can monitor latest updates on the WCFmmp facebook page. Support sometimes takes a bit of time to respond sometimes, so be a little patient. Thank you for all your efforts.

   Read on wp.org ↗
3. ★★★★★ seanm2e

   12mo ago

   WC Lovers are a fraudulent organisation. We paid and used in 2020 and decommissioned within a year. Two years later we got stung for an annual subscription and then last month (in 2025!) out of the blue we got stung again. In both instances we attempted to engage in email correspondence to resolve. No replies until we did an inbound sales query – they were all over that until they realised were were seeking recompense. If WC Lovers want to get in touch immediately and resolve, please do. If anyone else has had these issues, please comment or get in touch. This topic was modified 10 months, 3 weeks ago by seanm2e. This topic was modified 10 months, 3 weeks ago by seanm2e.

   Read on wp.org ↗
4. ★★★★★ vethe2

   1.3y ago

   The latest version 6.7.17 has an issue where non-admin accounts cannot upload images or view images in the uploaded media library. I had to roll back to version 6.7.16 for it to work normally again. Please fix this.

   Read on wp.org ↗
5. ★★★★★ Lalit Jindal

   1.3y ago

   Plugin functionality is okay but there is no support. The documentation is horribly written. The payment doesn’t work at all which is core functionality. They want you to waste your time with free versions so that you have to buy their paid payment plugin. They want you to fall for sunk cost fallacy. Not today, devil! 😀

   Read on wp.org ↗
6. ★★★★★ niyatisethia

   1.3y ago

   The plugin functions okay, but not compatible with a lot of plugins that add needed functionality. I’ve been using this for a few years (pro version), but they haven’t upgraded this over time. Their smugness also comes across in their response to queries. They take weeks together to respond and that too disinterested in helping.

   Read on wp.org ↗
7. ★★★★★ jacarrasquel

   1.4y ago

   This is the best multivendor plugin ever.

   Read on wp.org ↗
8. ★★★★★ Alaa Badr

   1.7y ago

   Wonderful support and plugins. very appreciated.

   Read on wp.org ↗

Recent releases and news for this plugin

1. — Version 6.7.28 Updated – 27/06/2026 Security – Fixed an Unauthenticated Authorization Bypass vulnerability that allowed arbitrary reply injection into store inquiries and unsolicited notification emails. Security – Fixed an Insecure Di 6.7.28
2. — Version 6.7.27 Updated – 25/04/2026 Enhance – PHP compatibility expanded: now supports versions 7.2–8.4 6.7.27
3. — Version 6.7.26 Updated – 16/03/2026 Security – Fixed an Authenticated IDOR vulnerability allowing unauthorized user deletion. Reported by Supakiad S. (m3ez). Security – Fixed an Authenticated IDOR vulnerability allowing unauthorized po 6.7.26
4. — Version 6.7.25 Updated – 07/02/2026 Fixed – Authenticated (Shop Manager+) Arbitrary Options Update vulnerability reported by Osvaldo Noe Gonzalez Del Rio, Credit goes to Osvaldo Noe Gonzalez Del Rio for identifying this issue. Fixed – 6.7.25
5. — Version 6.7.24 Updated – 20/12/2025 Fixed – PHP ‘Undefined index’ notice fixed in wcfm_save_page_analytics_data(). Enhance – WordPress 6.9+ compatibility check added Enhance – WooCommerce 10.4+ compatibility check added 6.7.24
6. — Version 6.7.23 Updated – 07/12/2025 Fixed – Allow access to wcfm pages for super admins in multisite setup. Fixed – PHP Deprecated warnings & minor fixes. 6.7.23

12 disclosed vulnerabilities on record for this plugin, all fixed in the current version. Sites on older versions stay exposed until they update.

1. Medium · 5.3 WCFM – Frontend Manager for WooCommerce <= 6.7.27 - Missing Authorization to Unauthenticated Arbitrary Inquiry Reply Injection via wcfm-my-account-enquiry-manage Controller ↗
   2026-07-10 CVE-2026-12994 Missing Authorization Affects <= 6.7.27 Patched in 6.7.28
2. Medium · 4.3 WCFM – Frontend Manager for WooCommerce <= 6.7.27 - Authenticated (Subscriber+) Missing Authorization to Arbitrary Vendor Data Manipulation via Multiple AJAX Handlers ↗
   2026-07-10 CVE-2026-10041 Authorization Bypass Through User-Controlled Key Affects <= 6.7.27 Patched in 6.7.28
3. High · 8.1 WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible <= 6.7.25 - Authenticated (Vendor+) Insecure Direct Object Reference to Arbitrary User Deletion ↗
   2026-05-01 CVE-2026-2554 Authorization Bypass Through User-Controlled Key Affects <= 6.7.25 Patched in 6.7.26
4. High · 8.1 WCFM - WooCommerce Frontend Manager <= 6.7.25 - Insecure Direct Object References to Autenticated (Vendor+) Arbitrary Post/Product Manipulation ↗
   2026-04-03 CVE-2026-4896 Authorization Bypass Through User-Controlled Key Affects <= 6.7.25 Patched in 6.7.26
5. High · 7.2 WCFM - WooCommerce Frontend Manager <= 6.7.24 - Authenticated (Shop Manager+) Arbitrary Options Update ↗
   2026-02-09 CVE-2026-0845 Missing Authorization Affects <= 6.7.24 Patched in 6.7.25
6. Medium · 4.3 WCFM – Frontend Manager for WooCommerce <= 6.7.24 - Missing Authorization ↗
   2025-12-15 CVE-2025-54004 Missing Authorization Affects <= 6.7.24 Patched in 6.7.25
7. Medium · 6.5 WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible <= 6.7.16 - Missing Authorization to Unauthenticated Plugin Settings Modification ↗
   2025-07-08 CVE-2025-3780 Missing Authorization Affects <= 6.7.16 Patched in 6.7.17
8. High · 8.8 WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible <= 6.7.12 - Insecure Direct Object Reference to Account Takeover/Privilege Escalation ↗
   2024-09-24 CVE-2024-8290 Authorization Bypass Through User-Controlled Key Affects <= 6.7.12 Patched in 6.7.13
9. Medium · 4.4 WCFM – Frontend Manager for WooCommerce <= 6.7.8 - Authenticated (Shop manager+) Stored Cross-Site Scripting ↗
   2024-03-25 CVE-2024-29929 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 6.7.8 Patched in 6.7.9
10. Medium · 6.3 WCFM Frontend Manager <= 6.5.13 - Cross-Site Request Forgery ↗
    2023-04-05 CVE-2022-4938 Cross-Site Request Forgery (CSRF) Affects <= 6.5.13 Patched in 6.6.0
11. Medium · 6.3 WCFM Frontend Manager <= 6.6.0 - Missing Authorization ↗
    2023-04-05 CVE-2022-4937 Missing Authorization Affects 6.6.0 Patched in 6.6.1
12. High · 8.8 WCFM - Frontend Manager for WooCommerce <= 6.5.11 - Customer/Subscriber+ SQL Injection ↗
    2021-10-11 CVE-2021-24835 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Affects <= 6.5.11 Patched in 6.5.12

Automated install-time checks, tested on PHP 8.1.12 · WP 7.0

Translated into 23 languages, 5 at 90% or more

Growth timeline

Install-tier crossings we have observed, and how long each tier took to outgrow

1. 2024-08-18 30K+ → 20K+ down after 3 days in tier
2. 2024-08-15 20K+ → 30K+ up after 3 days in tier
3. 2024-08-12 30K+ → 20K+ down after 1 days in tier
4. 2024-08-11 20K+ → 30K+ up after 1 days in tier
5. 2024-08-10 30K+ → 20K+ down

Competes with

The plugins that solve the same job, ranked by shared tags then reach, closest match first. The letter on the right is each plugin's health grade (A best, F worst).

• WCFM Marketplace – Multivendor Marketplace for WooCommerce 10K+ installs · 4.6★ · 3 shared tags A
• MultiVendorX – WooCommerce Multivendor Marketplace AI Powered Solutions 2K+ installs · 4.8★ · 3 shared tags A
• Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy 30K+ installs · 4.5★ · 2 shared tags A
• WCFM Membership – WooCommerce Memberships for Multivendor Marketplace 10K+ installs · 3.9★ · 2 shared tags B
• WC Vendors – WooCommerce Multivendor, WooCommerce Marketplace, Product Vendors 3K+ installs · 4.5★ · 2 shared tags A
• WCFM – WCFM Marketplace integrate Elementor 1K+ installs · 3.7★ · 2 shared tags D

Embed this report card

Drop a live Pulse card for WCFM – Frontend Manager for WooCommerce into a readme, a review or a deck. It updates itself.

WCFM – Frontend Manager for WooCommerce: 20K+ active installs, 4.5★ (286 reviews). Plugin Pulse (WP Mayor), as of 2026-08-29. https://plugins.wpmayor.com/plugin/wc-frontend-manager