CVE-2026-108695

The MultiVendorX WordPress plugin (through version 5.0.19 ) is vulnerable to an incorrect authorization flaw (CWE-863) within its settings REST endpoint. Attackers possessing the store_owner role can exploit this by sending POST requests to /wp-json/multivendorx/v1/settings. Because the endpoint ...

CVE-2026-12951 MultiVendorX <= 5.0.18 - Authenticated (Store Manager+) SQL Injection via 'order_by' Parameter

The Dc Woocommerce Multi Vendor plugin for WordPress is vulnerable to SQL Injection via the 'orderby' parameter of the /multivendorx/v1/compliance/report-abuse REST endpoint in versions up to and including 5.0.18. This is due to insufficient escaping on the user supplied parameter and lack of...