CVE-2026-127211

The MultiVendorX plugin for WordPress (versions before 5.0.22 ) is vulnerable to a broken access control flaw within the /wp-json/multivendorx/v1/stores REST route. The root cause is that the store_owner role possesses the edit_stores capability, yet the application fails to perform per-store own...

CVE-2024-8289

CVE-2024-8289 CVE-2024-8289 https://vulners.com/cve/CVE-2024-8289, Vendor wcmp Product MultiVendorX – The Ultimate WooCommerce Multivendor Marketplace Solution...

CVE-2026-119745

Sender plugin for WordPress before 2.11.3 contains a missing authorization vulnerability that allows any authenticated user, including Subscribers, to access a sensitive diagnostic dump by requesting the adminpostsenderdebugdownload action handled by downloadDebugFile without any capability, nonc...

PT-2026-136971

Name of the Vulnerable Software and Affected Versions Sender plugin for WordPress versions prior to 2.11.3 MultiVendorX plugin for WordPress versions prior to 5.0.21 Description A missing authorization flaw allows any authenticated user, such as those with Subscriber roles, to access a sensitive...

CVE-2026-114711

Subscriber Cross Site Scripting XSS in MultiVendorX = 5.0.20 versions...

EUVD-2026-114300

Subscriber Cross Site Scripting XSS in MultiVendorX = 5.0.20 versions...

CVE-2026-114711

The MultiVendorX plugin for WordPress versions

CVE-2026-114711 WordPress MultiVendorX plugin <= 5.0.20 - Cross Site Scripting (XSS) vulnerability

Subscriber Cross Site Scripting XSS in MultiVendorX = 5.0.20 versions...

CVE-2026-114711 WordPress MultiVendorX plugin <= 5.0.20 - Cross Site Scripting (XSS) vulnerability

Subscriber Cross Site Scripting XSS in MultiVendorX = 5.0.20 versions...

WordPress MultiVendorX plugin <= 5.0.20 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by leon figueira in WordPress Plugin MultiVendorX versions = 5.0.20...

CVE-2026-114711: MultiVendorX: Subscriber Cross Site Scripting (XSS) in MultiVendorX <= 5.0.20 versions.

Subscriber Cross Site Scripting XSS in MultiVendorX = 5.0.20 versions...

PT-2026-133750

Name of the Vulnerable Software and Affected Versions MultiVendorX versions prior to 5.0.21 Description Cross Site Scripting XSS exists in the software, allowing a user with Subscriber privileges to execute malicious scripts in the browser of other users. Recommendations Update to version 5.0.21 ...

CVE-2026-108695

MultiVendorX WordPress plugin through 5.0.19 contains an incorrect authorization vulnerability that allows vendor accounts to modify marketplace-wide settings via the settings REST endpoint. Attackers with the storeowner role can send POST requests to /wp-json/multivendorx/v1/settings, gated only...

CVE-2026-108695 MultiVendorX through 5.0.19 Incorrect Authorization via Settings REST Endpoint

MultiVendorX WordPress plugin through 5.0.19 contains an incorrect authorization vulnerability that allows vendor accounts to modify marketplace-wide settings via the settings REST endpoint. Attackers with the storeowner role can send POST requests to /wp-json/multivendorx/v1/settings, gated only...

EUVD-2026-96698

MultiVendorX WordPress plugin through 5.0.19 contains an incorrect authorization vulnerability that allows vendor accounts to modify marketplace-wide settings via the settings REST endpoint. Attackers with the storeowner role can send POST requests to /wp-json/multivendorx/v1/settings, gated only...

CVE-2026-108695

The MultiVendorX WordPress plugin (through version 5.0.19 ) is vulnerable to an incorrect authorization flaw (CWE-863) within its settings REST endpoint. Attackers possessing the store_owner role can exploit this by sending POST requests to /wp-json/multivendorx/v1/settings. Because the endpoint ...

CVE-2026-108695 MultiVendorX through 5.0.19 Incorrect Authorization via Settings REST Endpoint

MultiVendorX WordPress plugin through 5.0.19 contains an incorrect authorization vulnerability that allows vendor accounts to modify marketplace-wide settings via the settings REST endpoint. Attackers with the storeowner role can send POST requests to /wp-json/multivendorx/v1/settings, gated only...

CVE-2026-108695 MultiVendorX through 5.0.19 Incorrect Authorization via Settings REST Endpoint

MultiVendorX WordPress plugin through 5.0.19 contains an incorrect authorization vulnerability that allows vendor accounts to modify marketplace-wide settings via the settings REST endpoint. Attackers with the storeowner role can send POST requests to /wp-json/multivendorx/v1/settings, gated only...

CVE-2026-108695: Incorrect Authorization

MultiVendorX WordPress plugin through 5.0.19 contains an incorrect authorization vulnerability that allows vendor accounts to modify marketplace-wide settings via the settings REST endpoint. Attackers with the storeowner role can send POST requests to /wp-json/multivendorx/v1/settings, gated only...

PT-2026-109989

Name of the Vulnerable Software and Affected Versions MultiVendorX versions prior to 5.0.20 Description An incorrect authorization issue exists that allows users with the store owner role to modify marketplace-wide settings. By sending POST requests to the '/wp-json/multivendorx/v1/settings'...