MultiVendorX vulnerabilities

🔔 Create alert RSS

Published CVEs affecting MultiVendorX products: 5 record(s), with severity, exploitation and fixes.

MultiVendorX 3 Product Catalog Enquiry for WooCommerce by MultiVendorX 1 WooCommerce Product Stock Alert 1

Exploited only (KEV) →

CVE-2026-108695 High · 7.1 CWE-863 Oct 10, 2026

MultiVendorX through 5.0.19 Incorrect Authorization via Settings REST Endpoint

MultiVendorX WordPress plugin through 5.0.19 contains an incorrect authorization vulnerability that allows vendor accounts to modify marketplace-wide settings via the settings REST endpoint. Attackers with the store_owner role can send POST requests to /wp-json/multivendorx/v1/settings, gated only by edit_stores, to overwrite commission, payout, and onboarding settings.

CVE-2026-81792 Medium · 6.5 CWE-266 Sep 8, 2026

WordPress Product Catalog Enquiry for WooCommerce by MultiVendorX plugin <= 6.1.5 - Privilege Escalation vulnerability

Incorrect Privilege Assignment vulnerability in MultiVendorX Product Catalog Enquiry for WooCommerce by MultiVendorX woocommerce-catalog-enquiry allows Privilege Escalation.This issue affects Product Catalog Enquiry for WooCommerce by MultiVendorX: from n/a through 6.1.5.

CVE-2026-66651 Medium · 6.5 CWE-862 Aug 18, 2026

WordPress MultiVendorX plugin <= 5.0.20 - Broken Access Control vulnerability

Missing Authorization vulnerability in MultiVendorX MultiVendorX dc-woocommerce-multi-vendor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MultiVendorX: from n/a through 5.0.20.

CVE-2026-61945 Medium · 6.5 CWE-497 Jul 23, 2026

WordPress WooCommerce Product Stock Alert plugin <= 3.0.6 - Sensitive Data Exposure vulnerability

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in MultiVendorX WooCommerce Product Stock Alert allows Retrieve Embedded Sensitive Data. This issue affects WooCommerce Product Stock Alert: from n/a through 3.0.6.

CVE-2025-49916 High · 8.6 CWE-862 Oct 22, 2025

WordPress MultiVendorX plugin <= 4.2.23 - Broken Access Control vulnerability

Missing Authorization vulnerability in MultiVendorX MultiVendorX dc-woocommerce-multi-vendor allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects MultiVendorX: from n/a through <= 4.2.23.