CVE-2025-9054: Missing Authorization

The MultiLoca - WooCommerce Multi Locations Inventory Management plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the 'wcmlimsettingsajaxhandler' function in all versions up to, and including, 4.2.8...

CVE-2024-13341: Improper Neutralization of Special Elements used in an SQL Command

The MultiLoca - WooCommerce Multi Locations Inventory Management plugin for WordPress is vulnerable to SQL Injection via the 'data-id' parameter in all versions up to, and including, 4.1.11 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the...

PT-2025-2123

Name of the Vulnerable Software and Affected Versions The MultiLoca - WooCommerce Multi Locations Inventory Management plugin for WordPress versions up to, and including, 4.1.11 Description The issue allows authenticated attackers, with Subscriber-level access and above, to perform SQL Injection...