Multivendorx
Approved changes feed: RSS · Atom
cpe:2.3:a:multivendorx:multivendorx:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Multivendorx (70b693de-bbfc-5178-8e3c-d1a01af683f0) |
|---|---|
| Product | Multivendorx (967cfe58-a04f-54f6-b2a5-15cb6b025a3c) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from purl2cpe mapping
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/multivendorx/multivendorx |
purl2cpe | 2026-06-01 10:12:06.164887 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-119745 |
vulnerable | 2026-11-04 15:00:17.164364 |
Sender WordPress Plugin < 2.11.3 Broken Access Control via admin_post_sender_debug_download
MEDIUM (4.3)
Sender plugin for WordPress before 2.11.3 contains a missing authorization vulnerability that allows any authenticated user, including Subscribers, to access a sensitive diagnostic dump by requesting the admin_post_sender_debug_download action handled by downloadDebugFile() without any capability, nonce, or referer check. Attackers can exploit this flaw via wp-admin/admin-post.php?action=sender_debug_download to retrieve WordPress, PHP, WooCommerce, and server version details, the full active plugin inventory, active theme information, and plugin settings including the connected Sender account resource key and account metadata.
Published: 2026-11-04T14:01:14.109Z
Updated: 2026-11-04T18:45:28.642Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-108695 |
vulnerable | 2026-11-03 10:18:02.255819 |
MultiVendorX through 5.0.19 Incorrect Authorization via Settings REST Endpoint
HIGH (7.1)
MultiVendorX WordPress plugin through 5.0.19 contains an incorrect authorization vulnerability that allows vendor accounts to modify marketplace-wide settings via the settings REST endpoint. Attackers with the store_owner role can send POST requests to /wp-json/multivendorx/v1/settings, gated only by edit_stores, to overwrite commission, payout, and onboarding settings.
Published: 2026-10-11T01:35:44.973Z
Updated: 2026-10-14T02:43:25.800Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-66441 |
vulnerable | 2026-09-16 04:32:55.094873 |
WordPress MultiVendorX plugin <= 5.0.10 - Broken Access Control vulnerability
HIGH (7.5)
Unauthenticated Broken Access Control in MultiVendorX <= 5.0.10 versions.
Published: 2026-08-13T13:36:53.716Z
Updated: 2026-08-13T15:47:56.330Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-49916 |
vulnerable | 2026-06-08 07:29:15.102002 |
WordPress MultiVendorX plugin <= 4.2.23 - Broken Access Control vulnerability
HIGH (8.6)
Missing Authorization vulnerability in MultiVendorX MultiVendorX dc-woocommerce-multi-vendor allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects MultiVendorX: from n/a through <= 4.2.23.
Published: 2025-10-22T14:32:12.420Z
Updated: 2026-04-28T16:13:07.903Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-48263 |
vulnerable | 2026-06-08 07:27:15.629924 |
WordPress MultiVendorX plugin <= 4.2.22 - Cross Site Scripting (XSS) Vulnerability
MEDIUM (6.5)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MultiVendorX MultiVendorX dc-woocommerce-multi-vendor allows Stored XSS.This issue affects MultiVendorX: from n/a through <= 4.2.22.
Published: 2025-05-19T14:45:11.886Z
Updated: 2026-05-12T00:19:00.708Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-48261 |
vulnerable | 2026-06-08 07:27:15.627719 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-24706 |
vulnerable | 2026-06-08 07:12:49.766731 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-8289 |
vulnerable | 2026-06-08 07:00:24.060694 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-51355 |
vulnerable | 2026-06-08 06:16:17.354421 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.