CVE-2026-66651

Unauthenticated Broken Access Control in MultiVendorX = 5.0.14 versions...

EUVD-2026-60931

Unauthenticated Broken Access Control in MultiVendorX = 5.0.14 versions...

CVE-2026-66651

MultiVendorX WordPress plugin (versions ≤ 5.0.14) has an unauthenticated broken access control flaw. CVSS 6.5 (Medium) — network-reachable, no auth needed, low confidentiality and integrity impact. No patch version or exploit details provided; update once a fixed release is available. Monitor Pat...

CVE-2026-66651 WordPress MultiVendorX plugin <= 5.0.14 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in MultiVendorX = 5.0.14 versions...

CVE-2026-66651

Unauthenticated Broken Access Control in MultiVendorX = 5.0.14 versions...

CVE-2026-66441

Unauthenticated Broken Access Control in MultiVendorX = 5.0.10 versions...

EUVD-2026-57867

Unauthenticated Broken Access Control in MultiVendorX = 5.0.10 versions...

CVE-2026-66441

CVE-2026-66441 affects WordPress MultiVendorX plugin versions up to 5.0.10, with unauthenticated broken access control. The available sources identify the affected product and the vulnerability class but do not provide a confirmed patch version or remediation steps. CVSS v3.1 base score 7.5 (HIGH...

CVE-2026-66441

Unauthenticated Broken Access Control in MultiVendorX = 5.0.10 versions...

CVE-2026-66441 WordPress MultiVendorX plugin <= 5.0.10 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in MultiVendorX = 5.0.10 versions...

PT-2026-71554

Unauthenticated Broken Access Control in MultiVendorX = 5.0.10 versions...

WordPress MultiVendorX plugin <= 5.0.10 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Uma Mo in WordPress Plugin MultiVendorX versions = 5.0.10...

CVE-2026-16746

CVE-2026-16746 affects the WordPress plugin MultiVendorX prior to 5.0.11. The REST API endpoint fails to verify that the requested store belongs to the current user, enabling any vendor-level user to read other vendors’ commission and financial data. The description does not specify affected vers...

CVE-2026-16746 MultiVendorX < 5.0.11 - Store Owner+ Cross-Store Commission Data Disclosure via commissions REST Endpoint

The MultiVendorX WordPress plugin before 5.0.11 does not verify that the requested store belongs to the current user in one of its REST API endpoints, allowing any vendor-level user to read other vendors' commission and financial data...

WordPress MultiVendorX plugin < 5.0.11 - Store Owner+ Cross-Vendor Store Takeover and Deletion vulnerability

Store Owner+ Cross-Vendor Store Takeover and Deletion vulnerability discovered by Pedro Pinho in WordPress Plugin MultiVendorX versions 5.0.11...

CVE-2026-16605 MultiVendorX < 5.0.11 - Store Owner+ Cross-Vendor Store Takeover and Deletion via Missing Authorization

The MultiVendorX WordPress plugin before 5.0.11 does not verify that the store targeted through its REST API belongs to the requesting vendor, allowing an authenticated vendor Store Owner and above to view, take over, permanently delete, or modify any other vendor's store on the marketplace...

EUVD-2026-53106

The MultiVendorX WordPress plugin before 5.0.11 does not verify that the store targeted through its REST API belongs to the requesting vendor, allowing an authenticated vendor Store Owner and above to view, take over, permanently delete, or modify any other vendor's store on the marketplace...

EUVD-2026-48249

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in MultiVendorX WooCommerce Product Stock Alert allows Retrieve Embedded Sensitive Data. This issue affects WooCommerce Product Stock Alert: from n/a through 3.0.6...

CVE-2026-12941

The MultiVendorX plugin for WordPress (WooCommerce Multivendor) ≤ 5.0.9 is vulnerable to a generic SQL Injection via the order_by parameter. Root cause: insufficient escaping of user input and lack of proper query preparation. Attack requires an authenticated user with subscriber-level access; vi...

CVE-2026-12941 MultiVendorX <= 5.0.9 - Authenticated (Store Owner+) SQL Injection via 'order_by' Parameter

The MultiVendorX – WooCommerce Multivendor Marketplace AI Powered Solutions plugin for WordPress is vulnerable to generic SQL Injection via the 'orderby' parameter in all versions up to, and including, 5.0.9 due to insufficient escaping on the user supplied parameter and lack of sufficient...