Limited-Time Offer

Get Extra 20% off on FullCharge Yearly Plan — available for first 10 users only. Don’t miss out! 🚀

TrackWP

WCFM Marketplace · Version history

WCFM Marketplace changelog and version history

Latest version
3.8.4
Nov 2, 2026 (8 days ago)
Releases
142
since 2018
In the last year
12
about one every 32 days
Tested up to
WordPress 7.1.4
PHP 7.4 or later

Releases each year

  • 201831 releases
  • 201944 releases
  • 202021 releases
  • 20218 releases
  • 20227 releases
  • 20237 releases
  • 20249 releases
  • 20256 releases
  • 20269 releases

20269 releases

  1. WCFM Marketplace 3.8.4Latest

    • Updated – 02/11/2026
    • Fixed – Broken Access Control vulnerability in the marketplace setup wizard, where an unauthenticated visitor could reach the wizard and its plugin installer through wp-admin/admin-ajax.php, reported by mamgad (Patchstack), Credit goes to mamgad for identifying this issue.
    • Security – The setup wizard and each of its plugin install handlers now require the activate_plugins capability, filterable through wcfmmp_setup_page_required_capability.
    • Fixed – Stored Cross-Site Scripting (XSS) vulnerability in the vendor store phone and social profile fields, where a vendor could inject executable HTML that ran in the admin vendor list, on the store page and in the product page’s store tab, reported by Jakub Herman (Wordfence), Credit goes to Jak…
    • Security – The store phone, store email, customer support details and social profile links are now escaped wherever they are rendered, including the [wcfm_store_info] shortcode and the store header’s email link. Social profile links that use a javascript: or other unsafe URL scheme are no longer li…
    • Fixed – Stored Cross-Site Scripting (XSS) vulnerability in the store banner and store list card, where a vendor could place executable HTML around a valid YouTube URL in the video banner, which got past the 3.8.3 fix and ran for anyone who visited the store page or the [wcfm_stores] store list, rep…
    • Security – Store video banners now embed a video only when the whole value is a YouTube URL, and build the embed from the video ID alone, so no other part of the banner value is printed.
    • Fixed – Broken Access Control vulnerability in refund requests, where any vendor or vendor staff member could approve or reject other vendors’ refund requests through wp-admin/admin-ajax.php, which created real refunds on those vendors’ orders and changed their commissions, reported by mroccon (Pat…
    • Security – Approving and rejecting refund requests now requires a store manager who is not a vendor (the manage_woocommerce capability, filterable through wcfmmp_refund_moderation_capability), as the Refund Requests dashboard already showed. Vendors’ own requests are still approved automatically wh…
    • Fixed – A refund request could be approved again after it was completed, which refunded the order once more each time. Only refund requests that are still awaiting approval are now approved or rejected.
    • Fixed – Broken Access Control vulnerability in the WooCommerce and WordPress REST APIs, where vendors and vendor staff kept out of wp-admin could still read every store’s orders, refunds, subscriptions, bookings, customers, reviews and reports, including customers’ names, emails and phone numbers,…
    • Security – While a vendor or vendor staff member without the Backend Access (wp-admin) capability uses a REST route that is not scoped to their own store, those store-wide capabilities are withheld (filterable through wcfmmp_rest_vendor_withheld_capabilities). Vendors and staff with Backend Access…
    • Fixed – Saving a vendor’s profile, by the vendor or from the vendor’s page in the admin dashboard, deleted the vendor’s Additional Info answers to registration fields that were not on the form, such as the fields of a membership plan. The Additional Info section now also shows the registration fiel…
    • Fixed – The customer Refund button also showed in the order details on the order received (thank you) and order tracking pages, including to guest checkout customers, where clicking it did nothing. It now shows only on My Account pages and only to the order’s own customer, where a refund can be req…
    • Fixed – Approving a partial refund request that covered the rest of an item, such as one unit of a single-unit item, left the request’s vendor ledger entry pending. The ledger entry created with the request is now marked completed with the amount refunded.
    • Fixed – Rewrite rules were rebuilt on every front-end and AJAX request, slowing down page loads.
    • Enhance – WordPress 7.1+ compatibility check added
    • Enhance – WooCommerce 11.2+ compatibility check added

  2. WCFM Marketplace 3.8.3

    • Updated – 30/08/2026
    • Fixed – Stored Cross-Site Scripting (XSS) vulnerability in the store banner and store list card, where a vendor’s video banner value was rendered without escaping whenever it was not a valid YouTube URL.
    • Security – Store video banners now render an embed only for a valid YouTube URL and no longer output the raw banner value.
    • Fixed – Stored Cross-Site Scripting (XSS) vulnerability in the [wcfm_stores] and [wcfm_stores_map] shortcodes, where a contributor-level user could inject executable HTML through the store search and radius filter attributes, reported by Ananda Dhakal (Patchstack), Credit goes to Ananda Dhakal for…
    • Security – The store list search form now escapes the search query along with the radius range and coordinate values before they are rendered into the search form markup.

  3. WCFM Marketplace 3.8.2

    • Updated – 25/08/2026
    • Fixed – Stored Cross-Site Scripting (XSS) vulnerability in the [wcfm_store_info] shortcode, where a contributor-level user could break out of a class attribute through the data, icon and label attributes and inject executable HTML, reported by Ananda Dhakal (Patchstack), Credit goes to Ananda Dhaka…
    • Security – The [wcfm_store_info] shortcode now escapes the data, icon and label attribute values before they are rendered into the store-info markup.
    • Fixed – Unauthenticated SQL Injection vulnerability in the distance-based shipping method, where a customer’s checkout location coordinates were used in the store-distance query without numeric validation, reported by Ivaylo Atanassov, Credit goes to Ivaylo Atanassov for identifying this issue.
    • Security – Store-distance calculations now force all incoming location coordinates to numeric values before they are used in any database query.
    • Fixed – Unauthenticated refund request creation on guest-checkout orders, where an anonymous visitor could submit refund requests against any guest order, reported by Shikhali Jamalzade, Credit goes to Shikhali Jamalzade for identifying this issue.
    • Security – Refund request submissions now require an authenticated customer and verify order ownership with a strict match.
    • Enhance – WooCommerce 11.0+ compatibility check added

  4. WCFM Marketplace 3.8.1

    • Updated – 30/07/2026
    • Fixed – Insecure Direct Object Reference allowing a vendor to unapprove or delete another vendor’s store review, reported by Mustafa Ahmed, Credit goes to Mustafa Ahmed for identifying this issue.
    • Security – Strengthened product review status updates to prevent cross-vendor manipulation.

  5. WCFM Marketplace 3.8.0

    • Updated – 28/07/2026
    • Feature – Stripe Split Pay: brand-new payment engine built on Stripe’s Payment Element and PaymentIntents, with up-to-date SCA / 3D Secure authentication for marketplace split payments.
    • Feature – Stripe Split Pay: full multi-vendor cart support, including Direct and Destination charge flows across sellers within a single order.
    • Feature – Stripe Split Pay: order-pay support for pay-for-order links and customer payment retries on the modern engine.
    • Feature – Stripe Split Pay: new “Stripe Split Pay Status” diagnostics panel to verify connection and configuration from the dashboard.
    • Enhance – Stripe Split Pay: bundled Stripe PHP SDK updated to v20.2.1 with a pinned API version for consistent, predictable behaviour.
    • Enhance – Stripe Split Pay: hardened the existing (legacy) payment path with typed error handling, idempotency keys, and a kill-switch to force the legacy engine when required.
    • Enhance – Stripe Split Pay: checkout pre-flight validation now flags vendor onboarding or connection issues before an order is placed.
    • Enhance – Added a developer filter to customise the store-list card output.
    • Enhance – Tagged store-list vendor queries with a context marker for more reliable third-party query targeting.
    • Enhance – Themes and page builders can still supply their own vendor store layout, and WCFM now points it out in the admin when something takes the store page over, so an unintended change does not go unnoticed. Integrations should use the new “wcfmmp_store_template” filter; “wcfmmp_enforce_store_t…
    • Fix – Stripe Split Pay: corrected application-fee and refund handling for Direct and Destination charges so vendor and admin shares always reconcile.
    • Fix – Vendor store pages triggered a fatal error alongside Divi (“Argument #1 ($template) must be of type string, null given”), because the store page was rendered without handing a template path back to WordPress.
    • Fix – Divi Theme Builder support on store pages now verifies each Divi function before calling it, so Divi releases that move or rename them no longer break the store page.
    • Fix – Store URLs that do not resolve to a visitable store (unknown slug, non-vendor user, or an offline store) now return a proper HTTP 404 with the theme’s 404 page, instead of a blank page.

  6. WCFM Marketplace 3.7.4

    • Updated – 27/06/2026
    • Security – Patched a Stored XSS vulnerability in the Media Manager.
    • Security – Strengthened vendor shipping zone authorization to prevent cross-vendor shipping setting manipulation.
    • Enhance – WordPress 7.0 compatibility check added.
    • Enhance – WooCommerce 10.9.1 compatibility check added.
    • Fix – Store Featured Products widget: “Hide out of stock items” no longer overrides the widget’s product visibility query.

  7. WCFM Marketplace 3.7.3

    • Updated – 07/05/2026
    • Security – Patched a SQL Injection vulnerability in the Reviews Dashboard.
    • Security – Patched an unauthenticated SQL Injection vulnerability in the Store List Map integration.

  8. WCFM Marketplace 3.7.2

    • Updated – 25/04/2026
    • Enhance – PHP compatibility expanded: now supports versions 7.2–8.4

  9. WCFM Marketplace 3.7.1

    • Updated – 07/02/2026
    • Fixed – PHP Fatal error: Uncaught Error: Call to undefined function wcfm_is_store_page.
    • Fixed – Broken Access Control vulnerability reported by benzdeus, Credit goes to benzdeus for identifying this issue.
    • Fixed – Insecure Direct Object Reference to Unauthenticated Arbitrary Refund Request Creation vulnerability reported by Gibran Abdillah, Credit goes to Gibran Abdillah for identifying this issue.
    • Enhance – Secured single and bulk media deletion.
    • Enhance – Secured shipping zone setting update by preventing cross-vendor setting manipulation.

20256 releases

  1. WCFM Marketplace 3.7.0

    • Updated – 19/12/2025
    • Fixed – Refund logic division by zero issue.
    • Enhance – WordPress 6.9+ compatibility check added
    • Enhance – WooCommerce 10.4+ compatibility check added

  2. WCFM Marketplace 3.6.17

    • Updated – 07/12/2025
    • Fixed – Notice: Function _load_textdomain_just_in_time was called incorrectly.
    • Fixed – Minor bug fixes

  3. WCFM Marketplace 3.6.16

    • Updated – 12/11/2025
    • Enhance – Added vendor display support for HPOS-based orders on the WP Admin orders list
    • Enhance – WooCommerce 10.3+ compatibility check added
    • Fixed – Resolved issue where orders with initial payment failures did not appear on the vendor dashboard
    • Fixed – Corrected distance rate shipping to display the proper distance unit on vendor dashboard
    • Fixed – Resolved Undefined variable error in store_info shortcode.

  4. WCFM Marketplace 3.6.15

    • Updated – 09/07/2025
    • Enhance – WordPrss 6.8+ compatibility check added
    • Enhance – WooCommerce 9.9+ compatibility check added

  5. WCFM Marketplace 3.6.14

    • Updated – 09/03/2025
    • Enhance – WooCommerce 9.7+ compatibility check added
    • Fixed – Stripe vendor connect issue for cross border countries. Now vendor needs to choose from a list of supported countries.
    • Fixed – Minor bug fixes

  6. WCFM Marketplace 3.6.13

    • Updated – 12/01/2025
    • Enhance – WordPress 6.7+ compatibility check added
    • Enhance – WooCommerce 9.5+ compatibility check added

20249 releases

  1. WCFM Marketplace 3.6.12

    • Updated – 02/10/2024
    • Fixed – Cross Site Scripting (XSS) vulnerability in store list search as reported by Le Ngoc Anh, Credit goes to Le Ngoc Anh for identifying this issue.
    • Fixed – PHP Fatal error Class Stripe\StripeClient not found when Woocommerce Booking plugin active
    • Fixed – Stripe Gateway is disabled. Please re-check withdrawal setting panel. This occurs mostly due to absence of Stripe Secret Key when Woocommerce Booking plugin active

  2. WCFM Marketplace 3.6.11

    • Updated – 23/09/2024
    • Enhanced – Added condition for missing source_transaction parameter in stripe transfer args
    • Fixed – Stripe Split Payment Issue with Cross-Border Payments: If the platform account and connected account(s) are not from the same country, Stripe payments fail when using “direct charge” mode.
    • Fixed – Minor typo & bug fixes

  3. WCFM Marketplace 3.6.10

    • Updated – 26/06/2024
    • Enhanced – WooCommerce 9.0+ compatibility added
    • Enhanced – Filter added for Store list page map that can show all store markers irrespective of pagination – apply_filters(‘wcfmmp_show_all_vendor_markers_on_map’, false)
    • Fixed – Order review page – payment radio button style issue, Payment stuck issue
    • Fixed – Removed double slash in URLs from the vendor store page tabs
    • Fixed – Stripe Split Pay – Direct charge stripe_fee added to admin & vendor both, a new filter added to enable/disable this behaviour – apply_filters( ‘wcfmmp_prevent_stripe_direct_charge_deduct_transaction_fee’, true )
    • Fixed – Stripe Split Pay – $wpdb->prefix was not added to wcfm_marketplace_orders table query correctly
    • Fixed – Stripe Split Pay – Separate charges & transfer – source_transaction parameter added
    • Fixed – Store new email sent twice issue, order with wc-checkout-draft status removed from getting store_new_order email

  4. WCFM Marketplace 3.6.9

    • Updated – 07/06/2024
    • Enhanced – WordPress 6.5+ compatibility added
    • Enhanced – WooCommerce 8.9+ compatibility added

  5. WCFM Marketplace 3.6.8

    • Updated – 23/03/2024
    • Enhanced – WooCommerce 8.7+ compatibility added
    • Fixed – Menu Manager Label changed after settings update
    • Fixed – Staff can not see orders in order-list page

  6. WCFM Marketplace 3.6.7

    • Updated – 10/03/2024
    • Fixed – WooCommerce Checkout page stuck when using Stripe Split Pay
    • Fixed – Duplicate product issue on shop page & more offers

  7. WCFM Marketplace 3.6.6

    • Updated – 20/02/2024
    • Enhance – WooCommerce 8.6+ compatibility added
    • Fixed – Order details page error when using WooCommerce 8.6+

  8. WCFM Marketplace 3.6.5

    • Updated – 11/01/2024
    • Fixed – Resolve fatal error in vendor dashboard payment settings due to missing admin stripe credentials

  9. WCFM Marketplace 3.6.4

    • Updated – 02/01/2024
    • Enhance – WooCommerce 8.4+ compatibility check added
    • Enhance – Stripe Connect implemented with Stripe Accounts API instead of the deprecated OAuth module
    • Fixed – Yith request a Quote compatibility issue
    • Fixed – Some SQL queries & minor issues fixed

20237 releases

  1. WCFM Marketplace 3.6.3

    • Updated – 23/11/2023
    • Enhance – WooCommerce 8.3+ compatibility check added
    • Enhance – WooComerce HPOS compatibility added
    • Fixed – Short code Cross site scripting(XSS) issue fixed

  2. WCFM Marketplace 3.6.2

  3. WCFM Marketplace 3.6.1

  4. WCFM Marketplace 3.6.0

  5. WCFM Marketplace 3.5.10

  6. WCFM Marketplace 3.5.9

  7. WCFM Marketplace 3.5.8

20227 releases

  1. WCFM Marketplace 3.5.7

  2. WCFM Marketplace 3.5.6

  3. WCFM Marketplace 3.5.5

  4. WCFM Marketplace 3.5.4

  5. WCFM Marketplace 3.5.3

  6. WCFM Marketplace 3.5.2

  7. WCFM Marketplace 3.5.1

20218 releases

  1. WCFM Marketplace 3.5.0

  2. WCFM Marketplace 3.4.12

  3. WCFM Marketplace 3.4.11

  4. WCFM Marketplace 3.4.10

  5. WCFM Marketplace 3.4.9

  6. WCFM Marketplace 3.4.8

  7. WCFM Marketplace 3.4.7

  8. WCFM Marketplace 3.4.6

202021 releases

  1. WCFM Marketplace 3.4.5

  2. WCFM Marketplace 3.4.4

  3. WCFM Marketplace 3.4.3

  4. WCFM Marketplace 3.4.2

  5. WCFM Marketplace 3.4.1

  6. WCFM Marketplace 3.4.0

  7. WCFM Marketplace 3.3.12

  8. WCFM Marketplace 3.3.11

  9. WCFM Marketplace 3.3.10

  10. WCFM Marketplace 3.3.9

  11. WCFM Marketplace 3.3.8

  12. WCFM Marketplace 3.3.7

  13. WCFM Marketplace 3.3.6

  14. WCFM Marketplace 3.3.5

  15. WCFM Marketplace 3.3.4

  16. WCFM Marketplace 3.3.3

  17. WCFM Marketplace 3.3.2

  18. WCFM Marketplace 3.3.1

  19. WCFM Marketplace 3.3.0

  20. WCFM Marketplace 3.2.8

  21. WCFM Marketplace 3.2.7

201944 releases

  1. WCFM Marketplace 3.2.6

  2. WCFM Marketplace 3.2.5

  3. WCFM Marketplace 3.2.4

  4. WCFM Marketplace 3.2.3

  5. WCFM Marketplace 3.2.2

  6. WCFM Marketplace 3.2.1

  7. WCFM Marketplace 3.2.0

  8. WCFM Marketplace 3.1.11

  9. WCFM Marketplace 3.1.10

  10. WCFM Marketplace 3.1.9

  11. WCFM Marketplace 3.1.8

  12. WCFM Marketplace 3.1.7

  13. WCFM Marketplace 3.1.6

  14. WCFM Marketplace 3.1.5

  15. WCFM Marketplace 3.1.4

  16. WCFM Marketplace 3.1.3

  17. WCFM Marketplace 3.1.2

  18. WCFM Marketplace 3.1.1

  19. WCFM Marketplace 3.1.0

  20. WCFM Marketplace 3.0.9

  21. WCFM Marketplace 3.0.8

  22. WCFM Marketplace 3.0.7

  23. WCFM Marketplace 3.0.6

  24. WCFM Marketplace 3.0.5

  25. WCFM Marketplace 3.0.4

  26. WCFM Marketplace 3.0.3

  27. WCFM Marketplace 3.0.2

  28. WCFM Marketplace 3.0.1

  29. WCFM Marketplace 3.0.0

  30. WCFM Marketplace 2.2.7

  31. WCFM Marketplace 2.2.6

  32. WCFM Marketplace 2.2.5

  33. WCFM Marketplace 2.2.4

  34. WCFM Marketplace 2.2.3

  35. WCFM Marketplace 2.2.2

  36. WCFM Marketplace 2.2.1

  37. WCFM Marketplace 2.2.0

  38. WCFM Marketplace 2.1.3

  39. WCFM Marketplace 2.1.2

  40. WCFM Marketplace 2.1.1

  41. WCFM Marketplace 2.1.0

  42. WCFM Marketplace 2.0.8

  43. WCFM Marketplace 2.0.7

  44. WCFM Marketplace 2.0.6

201831 releases

  1. WCFM Marketplace 2.0.5

  2. WCFM Marketplace 2.0.4

  3. WCFM Marketplace 2.0.3

  4. WCFM Marketplace 2.0.2

  5. WCFM Marketplace 2.0.1

  6. WCFM Marketplace 2.0.0

  7. WCFM Marketplace 1.2.7

  8. WCFM Marketplace 1.2.6

  9. WCFM Marketplace 1.2.5

  10. WCFM Marketplace 1.2.4

  11. WCFM Marketplace 1.2.3

  12. WCFM Marketplace 1.2.2

  13. WCFM Marketplace 1.2.1

  14. WCFM Marketplace 1.2.0

  15. WCFM Marketplace 1.1.4

  16. WCFM Marketplace 1.1.3

  17. WCFM Marketplace 1.1.2

  18. WCFM Marketplace 1.1.1

  19. WCFM Marketplace 1.1.0

  20. WCFM Marketplace 1.0.11

  21. WCFM Marketplace 1.0.10

  22. WCFM Marketplace 1.0.9

  23. WCFM Marketplace 1.0.8

  24. WCFM Marketplace 1.0.7

  25. WCFM Marketplace 1.0.6

  26. WCFM Marketplace 1.0.5

  27. WCFM Marketplace 1.0.4

  28. WCFM Marketplace 1.0.3

  29. WCFM Marketplace 1.0.2

  30. WCFM Marketplace 1.0.1

  31. WCFM Marketplace 1.0.0

Questions about WCFM Marketplace’s releases

What is the latest version of WCFM Marketplace?

3.8.4, released on Nov 2, 2026 (1 week ago). It’s tested up to WordPress 7.1.4 and needs PHP 7.4 or later.

How often is WCFM Marketplace updated?

12 releases in the last year, about one every 32 days. Its first release on WordPress.org dates from August 2018.

Know when your rivals ship

Track your plugin and its rivals: TrackWP sees each new release in the nightly snapshot and alerts you, with what it did to their rank.

Start free

Release dates come from the day each version’s folder was made in WCFM Marketplace’s WordPress.org SVN repository; the notes from its readme’s changelog, as its authors wrote it.