Advisories · Technology

MultiVendorX.

Every CVE that names MultiVendorX among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-114711 CVE record

CVSS 6.5 Medium

WordPress MultiVendorX plugin <= 5.0.20 - Cross Site Scripting (XSS) vulnerability
- MultiVendorX
- Cross-site scripting (XSS)
Not analysed yet 30 Oct 2026
CVE-2026-108695 CVE record

CVSS 7.1 High

MultiVendorX through 5.0.19 Incorrect Authorization via Settings REST Endpoint
- MultiVendorX
- Broken access control
Not analysed yet 11 Oct 2026
CVE-2026-74926 CVE record

CVSS 7.1 High

MultiVendorX 5.0.0 - 5.0.15 - Subscriber+ Arbitrary Store Data and Ownership Overwrite via stores REST Endpoint
- MultiVendorX
- Broken access control
Not analysed yet 16 Sept 2026
CVE-2026-74925 CVE record

CVSS 7.2 High

MultiVendorX 5.0.0 - 5.0.15 - Store Owner+ Privilege Escalation to Administrator
- MultiVendorX
- Privilege escalation
Not analysed yet 11 Sept 2026
CVE-2026-74927 CVE record

CVSS 5.3 Medium

MultiVendorX 5.0.13 - 5.0.14 - Unauthenticated Vendor PII and Payout Data Disclosure via stores REST Endpoint
- MultiVendorX
- Broken access control
Not analysed yet 2 Sept 2026
CVE-2026-66651 CVE record

CVSS 6.5 Medium

WordPress MultiVendorX plugin <= 5.0.20 - Broken Access Control vulnerability
- MultiVendorX
- Broken access control
Not analysed yet 18 Aug 2026
CVE-2026-66441 CVE record

CVSS 7.5 High

WordPress MultiVendorX plugin <= 5.0.10 - Broken Access Control vulnerability
- MultiVendorX
- Broken access control
Not analysed yet 13 Aug 2026
CVE-2026-16746 CVE record

CVSS 2.7 Low

MultiVendorX < 5.0.11 - Store Owner+ Cross-Store Commission Data Disclosure via commissions REST Endpoint
- MultiVendorX
- Broken access control
Not analysed yet 5 Aug 2026
CVE-2026-16605 CVE record

CVSS 7.2 High

MultiVendorX < 5.0.11 - Store Owner+ Cross-Vendor Store Takeover and Deletion via Missing Authorization
- MultiVendorX
- Broken access control
Not analysed yet 5 Aug 2026
CVE-2025-49916 CVE record

CVSS 8.6 High

WordPress MultiVendorX plugin <= 4.2.23 - Broken Access Control vulnerability
- MultiVendorX
- Broken access control
Not analysed yet 22 Oct 2025
CVE-2025-48261 CVE record

CVSS 7.5 High

WordPress MultiVendorX plugin <= 4.2.22 - Sensitive Data Exposure Vulnerability
- MultiVendorX
- Information disclosure
Not analysed yet 9 Jun 2025
CVE-2025-48263 CVE record

CVSS 6.5 Medium

WordPress MultiVendorX plugin <= 4.2.22 - Cross Site Scripting (XSS) Vulnerability
- MultiVendorX
- Cross-site scripting (XSS)
Not analysed yet 19 May 2025
CVE-2025-24706 CVE record

CVSS 6.5 Medium

WordPress MultiVendorX plugin <= 4.2.13 - Cross Site Scripting (XSS) vulnerability
- MultiVendorX
- Cross-site scripting (XSS)
Not analysed yet 24 Jan 2025
CVE-2023-51355 CVE record

CVSS 8.2 High

WordPress MultiVendorX plugin <= 4.0.23 - Broken Access Control vulnerability
- MultiVendorX
- Broken access control
Not analysed yet 9 Dec 2024