Multivendorx
Approved changes feed: RSS · Atom
cpe:2.3:a:multivendorx:multivendorx:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Multivendorx (70b693de-bbfc-5178-8e3c-d1a01af683f0) |
|---|---|
| Product | Multivendorx (967cfe58-a04f-54f6-b2a5-15cb6b025a3c) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from purl2cpe mapping |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/multivendorx/multivendorx |
purl2cpe | 2026-06-01 10:12:06.164887 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2025-49916 |
vulnerable | 2026-06-08 07:29:15.102002 |
WordPress MultiVendorX plugin <= 4.2.23 - Broken Access Control vulnerability
HIGH (8.6)
Missing Authorization vulnerability in MultiVendorX MultiVendorX dc-woocommerce-multi-vendor allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects MultiVendorX: from n/a through <= 4.2.23.
Published: 2025-10-22T14:32:12.420Z
Updated: 2026-04-28T16:13:07.903Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-48263 |
vulnerable | 2026-06-08 07:27:15.629924 |
WordPress MultiVendorX plugin <= 4.2.22 - Cross Site Scripting (XSS) Vulnerability
MEDIUM (6.5)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MultiVendorX MultiVendorX dc-woocommerce-multi-vendor allows Stored XSS.This issue affects MultiVendorX: from n/a through <= 4.2.22.
Published: 2025-05-19T14:45:11.886Z
Updated: 2026-05-12T00:19:00.708Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-48261 |
vulnerable | 2026-06-08 07:27:15.627719 |
WordPress MultiVendorX plugin <= 4.2.22 - Sensitive Data Exposure Vulnerability
HIGH (7.5)
Insertion of Sensitive Information Into Sent Data vulnerability in MultiVendorX MultiVendorX dc-woocommerce-multi-vendor allows Retrieve Embedded Sensitive Data.This issue affects MultiVendorX: from n/a through <= 4.2.22.
Published: 2025-06-09T15:53:56.298Z
Updated: 2026-04-29T09:51:55.692Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-24706 |
vulnerable | 2026-06-08 07:12:49.766731 |
WordPress MultiVendorX plugin <= 4.2.13 - Cross Site Scripting (XSS) vulnerability
MEDIUM (6.5)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MultiVendorX MultiVendorX dc-woocommerce-multi-vendor allows Stored XSS.This issue affects MultiVendorX: from n/a through <= 4.2.13.
Published: 2025-01-24T17:25:03.143Z
Updated: 2026-04-28T16:11:32.729Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-8289 |
vulnerable | 2026-06-08 07:00:24.060694 |
MultiVendorX – The Ultimate WooCommerce Multivendor Marketplace Solution <= 4.2.0 - Missing Authorization to Limited Vendor Privilege Escalation/Account Takeover
CRITICAL (9.8)
The MultiVendorX – The Ultimate WooCommerce Multivendor Marketplace Solution plugin for WordPress is vulnerable to privilege escalation/de-escalation and account takeover due to an insufficient capability check on the update_item_permissions_check and create_item_permissions_check functions in all versions up to, and including, 4.2.0. This makes it possible for unauthenticated attackers to change the password of any user with the vendor role, create new users with the vendor role, and demote other users like administrators to the vendor role.
Published: 2024-09-04T08:30:38.531Z
Updated: 2026-04-08T17:13:52.704Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-51355 |
vulnerable | 2026-06-08 06:16:17.354421 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.