MU
Product
MultiVendorX
18
CVEs
0
On KEV
9.8
Max CVSS
2
New 30D
Severity mix
Critical 2High 6Medium 10Low 0
Watch
Add MultiVendorX to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2025-0493 | 9.8 | Jan 31 | MultiVendorX – The Ultimate WooCommerce Multivendor Marketplace Solution <= 4.2.14 - Unauthenticated Limited Local File Inclusion Affected: before 4.2.15 |
| CVE-2024-8289 | 9.8 | Sep 4 | MultiVendorX – The Ultimate WooCommerce Multivendor Marketplace Solution <= 4.2.0 - Missing Authorization to Limited Vendor Privilege Escalation/Account Takeover Affected: before 4.2.1 |
| CVE-2024-31304 | 8.8 | Jun 9 | WordPress MultiVendorX Marketplace <= 4.1.3 - Broken Access Control vulnerability Affected: before 4.1.4 |
| CVE-2025-49916 | 8.6 | Oct 22 | WordPress MultiVendorX plugin <= 4.2.23 - Broken Access Control vulnerability Affected: through 4.2.23 |
| CVE-2023-51355 | 8.2 | Dec 9 | WordPress MultiVendorX plugin <= 4.0.23 - Broken Access Control vulnerability Affected: through 4.0.23 |
| CVE-2026-66441 | 7.5 | Aug 13 | WordPress MultiVendorX plugin <= 5.0.10 - Broken Access Control vulnerability Affected: through 5.0.10 |
| CVE-2025-48261 | 7.5 | Jun 9 | WordPress MultiVendorX plugin <= 4.2.22 - Sensitive Data Exposure Vulnerability Affected: through 4.2.22 |
| CVE-2026-108695 | 7.1 | Oct 11 | MultiVendorX through 5.0.19 Incorrect Authorization via Settings REST Endpoint Affected: through 5.0.19 |
| CVE-2026-114711 New | 6.5 | Oct 30 | WordPress MultiVendorX plugin <= 5.0.20 - Cross Site Scripting (XSS) vulnerability Affected: through 5.0.20 |
| CVE-2026-66651 | 6.5 | Aug 18 | WordPress MultiVendorX plugin <= 5.0.20 - Broken Access Control vulnerability Affected: through 5.0.20 |
| CVE-2025-2789 | 6.5 | Apr 5 | MultiVendorX – The Ultimate WooCommerce Multivendor Marketplace Solution <= 4.2.19 - Missing Authorization to Unauthenticated Table Rates Deletion Affected: before 4.2.20 |
| CVE-2025-24706 | 6.5 | Jan 24 | WordPress MultiVendorX plugin <= 4.2.13 - Cross Site Scripting (XSS) vulnerability Affected: through 4.2.13 |
| CVE-2024-9943 | 6.3 | Oct 24 | MultiVendorX – The Ultimate WooCommerce Multivendor Marketplace Solution <= 4.2.4 - Cross-Site Request Forgery to Vendor Updates Affected: before 4.2.5 |
| CVE-2025-48263 | 5.4 | May 19 | WordPress MultiVendorX plugin <= 4.2.22 - Cross Site Scripting (XSS) Vulnerability Affected: through 4.2.22 |
| CVE-2024-5259 | 5.4 | Jun 6 | MultiVendorX Marketplace – WooCommerce MultiVendor Marketplace Solution <= 4.1.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via hover_animation Parameter Affected: before 4.1.12 |
| CVE-2025-4101 | 4.3 | May 17 | MultiVendorX – WooCommerce Multivendor Marketplace Solutions <= 4.2.22 - Incorrect Authorization to Authenticated (Contributor+) Arbitrary Post Deletion Affected: before 4.2.23 |
| CVE-2024-9531 | 4.3 | Oct 24 | MultiVendorX – The Ultimate WooCommerce Multivendor Marketplace Solution <= 4.2.4 - Missing Authorization to Forged Vendor Profile Deletion Email Sending Affected: before 4.2.5 |
| CVE-2020-36741 | 4.3 | Jul 1 | MultiVendorX – MultiVendor Marketplace Solution For WooCommerce <= 3.5.7 - Cross-Site Request Forgery Bypass Affected: through 3.5.7 |
Showing 18