EUVD-2026-124725

MultiVendorX plugin for WordPress before 5.0.22 contains a broken access control vulnerability in the /wp-json/multivendorx/v1/stores REST route that allows authenticated vendors to access administrative flag handlers due to the storeowner role possessing the editstores capability and missing...

CVE-2026-127211

MultiVendorX plugin for WordPress before 5.0.22 contains a broken access control vulnerability in the /wp-json/multivendorx/v1/stores REST route that allows authenticated vendors to access administrative flag handlers due to the storeowner role possessing the editstores capability and missing...

CVE-2024-8289

CVE-2024-8289 CVE-2024-8289 https://vulners.com/cve/CVE-2024-8289, Vendor wcmp Product MultiVendorX – The Ultimate WooCommerce Multivendor Marketplace Solution...

CVE-2026-127211 MultiVendorX WordPress Plugin < 5.0.22 Broken Access Control via stores REST Route

MultiVendorX plugin for WordPress before 5.0.22 contains a broken access control vulnerability in the /wp-json/multivendorx/v1/stores REST route that allows authenticated vendors to access administrative flag handlers due to the storeowner role possessing the editstores capability and missing...

CVE-2026-127211

The MultiVendorX plugin for WordPress (versions before 5.0.22 ) is vulnerable to a broken access control flaw within the /wp-json/multivendorx/v1/stores REST route. The root cause is that the store_owner role possesses the edit_stores capability, yet the application fails to perform per-store own...

CVE-2026-127211: MultiVendorX MultiVendorX – WooCommerce Multivendor Marketplace AI Powered Solutions: MultiVendorX plugin for WordPress before 5.0.22 contains a broken access control vulnerability in the…

MultiVendorX plugin for WordPress before 5.0.22 contains a broken access control vulnerability in the /wp-json/multivendorx/v1/stores REST route that allows authenticated vendors to access administrative flag handlers due to the storeowner role possessing the editstores capability and missing...

PT-2026-146071

MultiVendorX plugin for WordPress before 5.0.22 contains a broken access control vulnerability in the /wp-json/multivendorx/v1/stores REST route that allows authenticated vendors to access administrative flag handlers due to the store owner role possessing the edit stores capability and missing...

CVE-2026-119745

Sender plugin for WordPress before 2.11.3 contains a missing authorization vulnerability that allows any authenticated user, including Subscribers, to access a sensitive diagnostic dump by requesting the adminpostsenderdebugdownload action handled by downloadDebugFile without any capability, nonc...

PT-2026-136971

Name of the Vulnerable Software and Affected Versions Sender plugin for WordPress versions prior to 2.11.3 MultiVendorX plugin for WordPress versions prior to 5.0.21 Description A missing authorization flaw allows any authenticated user, such as those with Subscriber roles, to access a sensitive...

CVE-2026-114711

Subscriber Cross Site Scripting XSS in MultiVendorX = 5.0.20 versions...

CVE-2026-114711

The MultiVendorX plugin for WordPress versions

EUVD-2026-114300

Subscriber Cross Site Scripting XSS in MultiVendorX = 5.0.20 versions...

CVE-2026-114711 WordPress MultiVendorX plugin <= 5.0.20 - Cross Site Scripting (XSS) vulnerability

Subscriber Cross Site Scripting XSS in MultiVendorX = 5.0.20 versions...

CVE-2026-114711 WordPress MultiVendorX plugin <= 5.0.20 - Cross Site Scripting (XSS) vulnerability

Subscriber Cross Site Scripting XSS in MultiVendorX = 5.0.20 versions...

WordPress MultiVendorX plugin <= 5.0.20 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by leon figueira in WordPress Plugin MultiVendorX versions = 5.0.20...

CVE-2026-114711: MultiVendorX: Subscriber Cross Site Scripting (XSS) in MultiVendorX <= 5.0.20 versions.

Subscriber Cross Site Scripting XSS in MultiVendorX = 5.0.20 versions...

PT-2026-133750

Name of the Vulnerable Software and Affected Versions MultiVendorX versions prior to 5.0.21 Description Cross Site Scripting XSS exists in the software, allowing a user with Subscriber privileges to execute malicious scripts in the browser of other users. Recommendations Update to version 5.0.21 ...

CVE-2026-108695

MultiVendorX WordPress plugin through 5.0.19 contains an incorrect authorization vulnerability that allows vendor accounts to modify marketplace-wide settings via the settings REST endpoint. Attackers with the storeowner role can send POST requests to /wp-json/multivendorx/v1/settings, gated only...

EUVD-2026-96698

MultiVendorX WordPress plugin through 5.0.19 contains an incorrect authorization vulnerability that allows vendor accounts to modify marketplace-wide settings via the settings REST endpoint. Attackers with the storeowner role can send POST requests to /wp-json/multivendorx/v1/settings, gated only...

CVE-2026-108695 MultiVendorX through 5.0.19 Incorrect Authorization via Settings REST Endpoint

MultiVendorX WordPress plugin through 5.0.19 contains an incorrect authorization vulnerability that allows vendor accounts to modify marketplace-wide settings via the settings REST endpoint. Attackers with the storeowner role can send POST requests to /wp-json/multivendorx/v1/settings, gated only...