CVE-2026-12951

The Dc Woocommerce Multi Vendor plugin for WordPress is vulnerable to SQL Injection via the 'orderby' parameter of the /multivendorx/v1/compliance/report-abuse REST endpoint in versions up to and including 5.0.18. This is due to insufficient escaping on the user supplied parameter and lack of...

CVE-2026-12951 MultiVendorX <= 5.0.18 - Authenticated (Store Manager+) SQL Injection via 'order_by' Parameter

The Dc Woocommerce Multi Vendor plugin for WordPress is vulnerable to SQL Injection via the 'orderby' parameter of the /multivendorx/v1/compliance/report-abuse REST endpoint in versions up to and including 5.0.18. This is due to insufficient escaping on the user supplied parameter and lack of...

CVE-2026-12951

The Dc Woocommerce Multi Vendor plugin for WordPress is vulnerable to SQL Injection in versions up to and including 5.0.18 . The flaw exists in the order_by parameter of the /multivendorx/v1/compliance/report-abuse REST endpoint. The root cause is the direct concatenation of user-supplied input i...

EUVD-2026-91246

The Dc Woocommerce Multi Vendor plugin for WordPress is vulnerable to SQL Injection via the 'orderby' parameter of the /multivendorx/v1/compliance/report-abuse REST endpoint in versions up to and including 5.0.18. This is due to insufficient escaping on the user supplied parameter and lack of...

PT-2026-104126

The Dc Woocommerce Multi Vendor plugin for WordPress is vulnerable to SQL Injection via the 'order by' parameter of the /multivendorx/v1/compliance/report-abuse REST endpoint in versions up to and including 5.0.18. This is due to insufficient escaping on the user supplied parameter and lack of...

CVE-2025-49916: Missing Authorization

Missing Authorization vulnerability in MultiVendorX MultiVendorX dc-woocommerce-multi-vendor allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects MultiVendorX: from n/a through = 4.2.23...

CVE-2025-48261: Insertion of Sensitive Information Into Sent Data

Insertion of Sensitive Information Into Sent Data vulnerability in MultiVendorX MultiVendorX dc-woocommerce-multi-vendor allows Retrieve Embedded Sensitive Data.This issue affects MultiVendorX: from n/a through = 4.2.22...

CVE-2025-48263: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in MultiVendorX MultiVendorX dc-woocommerce-multi-vendor allows Stored XSS.This issue affects MultiVendorX: from n/a through = 4.2.22...

CVE-2025-24706: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in MultiVendorX MultiVendorX dc-woocommerce-multi-vendor allows Stored XSS.This issue affects MultiVendorX: from n/a through = 4.2.13...

CVE-2023-51355: Missing Authorization

Missing Authorization vulnerability in MultiVendorX MultiVendorX dc-woocommerce-multi-vendor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MultiVendorX: from n/a through = 4.0.23...