CVE-2026-12951

The Dc Woocommerce Multi Vendor plugin for WordPress is vulnerable to SQL Injection via the 'orderby' parameter of the /multivendorx/v1/compliance/report-abuse REST endpoint in versions up to and including 5.0.18. This is due to insufficient escaping on the user supplied parameter and lack of...

WordPress MultiVendorX – WooCommerce Multivendor Marketplace AI Powered Solutions plugin <= 5.0.18 - Authenticated (Store Manager+) SQL Injection vulnerability

Authenticated Store Manager+ SQL Injection vulnerability discovered by Wordfence PRISM in WordPress Plugin MultiVendorX versions = 5.0.18...

CVE-2024-8289

CVE-2024-8289 CVE-2024-8289 https://vulners.com/cve/CVE-2024-8289, Proveedor wcmp Producto MultiVendorX – The Ultimate WooCommerce Multivendor Marketplace Solution...

WordPress MultiVendorX plugin 5.0.0-5.0.15 - Subscriber+ Arbitrary Store Data and Ownership Overwrite vulnerability

Subscriber+ Arbitrary Store Data and Ownership Overwrite vulnerability discovered by Farid Narimanov in WordPress Plugin MultiVendorX versions 5.0.0-5.0.15...

CVE-2026-74926

The MultiVendorX WordPress plugin before 5.0.16 does not verify that a user owns the store they are acting on in one of its REST API routes, allowing any authenticated user, such as a subscriber, to overwrite any store's details and payout settings and to replace the record of who owns it...

EUVD-2026-80174

The MultiVendorX WordPress plugin before 5.0.16 does not verify that a user owns the store they are acting on in one of its REST API routes, allowing any authenticated user, such as a subscriber, to overwrite any store's details and payout settings and to replace the record of who owns it...

CVE-2026-74926 MultiVendorX 5.0.0 - 5.0.15 - Subscriber+ Arbitrary Store Data and Ownership Overwrite via stores REST Endpoint

The MultiVendorX WordPress plugin before 5.0.16 does not verify that a user owns the store they are acting on in one of its REST API routes, allowing any authenticated user, such as a subscriber, to overwrite any store's details and payout settings and to replace the record of who owns it...

CVE-2026-74926

The MultiVendorX WordPress plugin (versions 5.0.0-5.0.15 ) is vulnerable to an authorization flaw because it fails to verify if a user owns the store they are attempting to modify via a REST API route . This allows any authenticated user, including those with subscriber privileges, to overwrite s...

CVE-2026-74926 MultiVendorX 5.0.0 - 5.0.15 - Subscriber+ Arbitrary Store Data and Ownership Overwrite via stores REST Endpoint

The MultiVendorX WordPress plugin before 5.0.16 does not verify that a user owns the store they are acting on in one of its REST API routes, allowing any authenticated user, such as a subscriber, to overwrite any store's details and payout settings and to replace the record of who owns it...

PT-2026-93275

The MultiVendorX WordPress plugin before 5.0.16 does not verify that a user owns the store they are acting on in one of its REST API routes, allowing any authenticated user, such as a subscriber, to overwrite any store's details and payout settings and to replace the record of who owns it...

CVE-2026-74926: Missing Authorization

The MultiVendorX WordPress plugin before 5.0.16 does not verify that a user owns the store they are acting on in one of its REST API routes, allowing any authenticated user, such as a subscriber, to overwrite any store's details and payout settings and to replace the record of who owns it...

WordPress MultiVendorX plugin 5.0.0-5.0.15 - Store Owner+ Privilege Escalation to Administrator vulnerability

Store Owner+ Privilege Escalation to Administrator vulnerability discovered by Philipp Doblhofer in WordPress Plugin MultiVendorX versions 5.0.0-5.0.15...

CVE-2026-74925

The MultiVendorX WordPress plugin before 5.0.16 does not restrict who can update its role and capability settings, allowing users holding its vendor role to grant that role administrator-level capabilities and take over the site...

EUVD-2026-75964

The MultiVendorX WordPress plugin before 5.0.16 does not restrict who can update its role and capability settings, allowing users holding its vendor role to grant that role administrator-level capabilities and take over the site...

CVE-2026-74925 MultiVendorX 5.0.0 - 5.0.15 - Store Owner+ Privilege Escalation to Administrator

The MultiVendorX WordPress plugin before 5.0.16 does not restrict who can update its role and capability settings, allowing users holding its vendor role to grant that role administrator-level capabilities and take over the site...

CVE-2026-74925 MultiVendorX 5.0.0 - 5.0.15 - Store Owner+ Privilege Escalation to Administrator

The MultiVendorX WordPress plugin before 5.0.16 does not restrict who can update its role and capability settings, allowing users holding its vendor role to grant that role administrator-level capabilities and take over the site...

CVE-2026-74925

The MultiVendorX WordPress plugin (versions 5.0.0-5.0.15 ) contains a privilege escalation vulnerability because it fails to restrict who can update its role and capability settings . This allows users with the vendor role to grant that role administrator-level capabilities , potentially leading ...

CVE-2026-74925: Improper Privilege Management

The MultiVendorX WordPress plugin before 5.0.16 does not restrict who can update its role and capability settings, allowing users holding its vendor role to grant that role administrator-level capabilities and take over the site...

PT-2026-89779

The MultiVendorX WordPress plugin before 5.0.16 does not restrict who can update its role and capability settings, allowing users holding its vendor role to grant that role administrator-level capabilities and take over the site...

CVE-2026-81792

Incorrect Privilege Assignment vulnerability in MultiVendorX Product Catalog Enquiry for WooCommerce by MultiVendorX woocommerce-catalog-enquiry allows Privilege Escalation.This issue affects Product Catalog Enquiry for WooCommerce by MultiVendorX: from n/a through 6.1.5...