Multivendorx
Approved changes feed: RSS · Atom
cpe:2.3:a:unknown:multivendorx:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Unknown (668ca391-a6cc-5e33-879b-83885214de33) |
|---|---|
| Product | Multivendorx (1d89354f-33e5-5fbc-8877-ab4c2048aea5) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-16746 |
vulnerable | 2026-09-16 04:32:56.968463 |
MultiVendorX < 5.0.11 - Store Owner+ Cross-Store Commission Data Disclosure via commissions REST Endpoint
The MultiVendorX WordPress plugin before 5.0.11 does not verify that the requested store belongs to the current user in one of its REST API endpoints, allowing any vendor-level user to read other vendors' commission and financial data.
Published: 2026-08-05T06:00:10.459Z
Updated: 2026-08-06T15:12:42.691Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-16605 |
vulnerable | 2026-09-16 04:32:56.487082 |
MultiVendorX < 5.0.11 - Store Owner+ Cross-Vendor Store Takeover and Deletion via Missing Authorization
The MultiVendorX WordPress plugin before 5.0.11 does not verify that the store targeted through its REST API belongs to the requesting vendor, allowing an authenticated vendor (Store Owner and above) to view, take over, permanently delete, or modify any other vendor's store on the marketplace.
Published: 2026-08-05T06:00:09.943Z
Updated: 2026-08-05T19:41:31.723Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-74925 |
vulnerable | 2026-09-16 04:32:49.348996 |
MultiVendorX 5.0.0 - 5.0.15 - Store Owner+ Privilege Escalation to Administrator
The MultiVendorX WordPress plugin before 5.0.16 does not restrict who can update its role and capability settings, allowing users holding its vendor role to grant that role administrator-level capabilities and take over the site.
Published: 2026-09-11T06:00:07.430Z
Updated: 2026-09-11T10:09:48.714Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.