Multivendorx
Approved changes feed: RSS · Atom
cpe:2.3:a:multivendorx:multivendorx:*:*:*:*:*:wordpress:*:*part: a version: * update: *
| Vendor | Multivendorx (70b693de-bbfc-5178-8e3c-d1a01af683f0) |
|---|---|
| Product | Multivendorx (967cfe58-a04f-54f6-b2a5-15cb6b025a3c) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | wordpress |
| Target hardware | * |
| Other | * |
Notes
Imported from purl2cpe mapping
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/multivendorx/multivendorx |
purl2cpe | 2026-06-01 10:12:06.183204 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-108695 |
vulnerable | 2026-11-03 10:18:02.256649 |
MultiVendorX through 5.0.19 Incorrect Authorization via Settings REST Endpoint
HIGH (7.1)
MultiVendorX WordPress plugin through 5.0.19 contains an incorrect authorization vulnerability that allows vendor accounts to modify marketplace-wide settings via the settings REST endpoint. Attackers with the store_owner role can send POST requests to /wp-json/multivendorx/v1/settings, gated only by edit_stores, to overwrite commission, payout, and onboarding settings.
Published: 2026-10-11T01:35:44.973Z
Updated: 2026-10-14T02:43:25.800Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-4101 |
vulnerable | 2026-06-08 07:29:15.409148 |
MultiVendorX – WooCommerce Multivendor Marketplace Solutions <= 4.2.22 - Incorrect Authorization to Authenticated (Contributor+) Arbitrary Post Deletion
MEDIUM (4.3)
The MultiVendorX – WooCommerce Multivendor Marketplace Solutions plugin for WordPress is vulnerable to unauthorized loss of data due to a misconfigured capability check on the 'delete_fpm_product' function in all versions up to, and including, 4.2.22. This makes it possible for authenticated attackers, with Contributor-level access and above, to delete arbitrary posts, pages, attachments, and products. The vulnerability was partially patched in version 4.2.22.
Published: 2025-05-17T12:22:42.688Z
Updated: 2026-04-08T16:55:32.506Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-48263 |
vulnerable | 2026-06-08 07:27:15.629966 |
WordPress MultiVendorX plugin <= 4.2.22 - Cross Site Scripting (XSS) Vulnerability
MEDIUM (6.5)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MultiVendorX MultiVendorX dc-woocommerce-multi-vendor allows Stored XSS.This issue affects MultiVendorX: from n/a through <= 4.2.22.
Published: 2025-05-19T14:45:11.886Z
Updated: 2026-05-12T00:19:00.708Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-48261 |
vulnerable | 2026-06-08 07:27:15.628387 |
WordPress MultiVendorX plugin <= 4.2.22 - Sensitive Data Exposure Vulnerability
HIGH (7.5)
Insertion of Sensitive Information Into Sent Data vulnerability in MultiVendorX MultiVendorX dc-woocommerce-multi-vendor allows Retrieve Embedded Sensitive Data.This issue affects MultiVendorX: from n/a through <= 4.2.22.
Published: 2025-06-09T15:53:56.298Z
Updated: 2026-04-29T09:51:55.692Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-2789 |
vulnerable | 2026-06-08 07:16:58.330891 |
MultiVendorX – The Ultimate WooCommerce Multivendor Marketplace Solution <= 4.2.19 - Missing Authorization to Unauthenticated Table Rates Deletion
MEDIUM (5.3)
The MultiVendorX – Empower Your WooCommerce Store with a Dynamic Multivendor Marketplace – Build the Next Amazon, eBay, Etsy plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the delete_table_rate_shipping_row function in all versions up to, and including, 4.2.19. This makes it possible for unauthenticated attackers to delete Table Rates that can impact the shipping cost calculations.
Published: 2025-04-05T05:32:14.306Z
Updated: 2026-04-08T17:19:26.104Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-0493 |
vulnerable | 2026-06-08 07:02:24.712462 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-9943 |
vulnerable | 2026-06-08 07:00:28.948404 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-9531 |
vulnerable | 2026-06-08 07:00:28.131925 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-8289 |
vulnerable | 2026-06-08 07:00:24.063181 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-5259 |
vulnerable | 2026-06-08 06:56:15.345346 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-31304 |
vulnerable | 2026-06-08 06:35:31.268849 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-36741 |
vulnerable | 2026-06-08 05:25:49.512810 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.