CVE-2026-66625

Administrator SQL Injection in WC Vendors Marketplace = 2.7.2.1 versions...

EUVD-2026-81507

Administrator SQL Injection in WC Vendors Marketplace = 2.7.2.1 versions...

CVE-2026-66625 WordPress WC Vendors Marketplace plugin <= 2.7.2.1 - SQL Injection vulnerability

Administrator SQL Injection in WC Vendors Marketplace = 2.7.2.1 versions...

CVE-2026-66625

WC Vendors Marketplace , a WordPress plugin, is vulnerable to an administrator-level SQL injection in versions

CVE-2026-66625 WordPress WC Vendors Marketplace plugin <= 2.7.2.1 - SQL Injection vulnerability

Administrator SQL Injection in WC Vendors Marketplace = 2.7.2.1 versions...

WordPress WC Vendors Marketplace plugin <= 2.7.2.1 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin WC Vendors Marketplace versions = 2.7.2.1...

CVE-2026-66625: Improper Neutralization of Special Elements used in an SQL Command

Administrator SQL Injection in WC Vendors Marketplace = 2.7.2.1 versions...

CVE-2026-81426

The WC Vendors WordPress plugin before 2.7.2.1 does not have CSRF protection on some of its front-end order shipment status actions, which could allow attackers to make a logged-in vendor change the shipment status of their own orders via a crafted request...

CVE-2026-81427

The WC Vendors WordPress plugin before 2.7.2.1 does not verify that the vendor submitting a front-end order shipment status change owns the referenced order, allowing any authenticated vendor to mark another vendor's order as shipped, add an order note falsely attributed to the victim vendor, and...

CVE-2026-81428

The WC Vendors WordPress plugin before 2.7.2.1 does not verify ownership or the object type of user-supplied IDs when saving product variations, allowing authenticated users with the vendor role to modify product variations belonging to other vendors, and to change the status and title of arbitra...

CVE-2026-81428

The WC Vendors WordPress plugin (versions before 2.7.2.1 ) is vulnerable to an Insecure Direct Object Reference (IDOR) flaw. The root cause is a failure to verify the ownership or object type of user-supplied IDs when saving product variations. This allows authenticated users with the vendor role...

CVE-2026-81427

The WC Vendors WordPress plugin, in versions before 2.7.2.1 , is vulnerable to a cross-vendor order shipment status change. The root cause is a failure to verify that the vendor submitting a front-end order shipment status change actually owns the referenced order. This allows any authenticated v...

WordPress WC Vendors plugin < 2.7.2.1 - Vendor+ Cross-Vendor Order Shipment Status Change vulnerability

Vendor+ Cross-Vendor Order Shipment Status Change vulnerability discovered by Bhaveshkumar Parmar in WordPress Plugin WC Vendors Marketplace versions 2.7.2.1...

EUVD-2026-69855

The WC Vendors WordPress plugin before 2.7.2.1 does not verify ownership or the object type of user-supplied IDs when saving product variations, allowing authenticated users with the vendor role to modify product variations belonging to other vendors, and to change the status and title of arbitra...

EUVD-2026-69853

The WC Vendors WordPress plugin before 2.7.2.1 does not have CSRF protection on some of its front-end order shipment status actions, which could allow attackers to make a logged-in vendor change the shipment status of their own orders via a crafted request...

EUVD-2026-69854

The WC Vendors WordPress plugin before 2.7.2.1 does not verify that the vendor submitting a front-end order shipment status change owns the referenced order, allowing any authenticated vendor to mark another vendor's order as shipped, add an order note falsely attributed to the victim vendor, and...

WordPress WC Vendors plugin < 2.7.2.1 - Vendor+ Cross-Vendor Product and Arbitrary Post Modification vulnerability

Vendor+ Cross-Vendor Product and Arbitrary Post Modification vulnerability discovered by Usama Arshad in WordPress Plugin WC Vendors Marketplace versions 2.7.2.1...

CVE-2026-81427 WC Vendors < 2.7.2.1 - Vendor+ Cross-Vendor Order Shipment Status Change

The WC Vendors WordPress plugin before 2.7.2.1 does not verify that the vendor submitting a front-end order shipment status change owns the referenced order, allowing any authenticated vendor to mark another vendor's order as shipped, add an order note falsely attributed to the victim vendor, and...

CVE-2026-81426

The WC Vendors WordPress plugin versions before 2.7.2.1 is vulnerable to a Cross-Site Request Forgery (CSRF) attack. The root cause is a lack of CSRF protection on specific front-end actions related to order shipment status. This allows an attacker to trick a logged-in vendor into unexpectedly ch...

CVE-2026-81428 WC Vendors < 2.7.2.1 - Vendor+ Cross-Vendor Product and Arbitrary Post Modification via IDOR

The WC Vendors WordPress plugin before 2.7.2.1 does not verify ownership or the object type of user-supplied IDs when saving product variations, allowing authenticated users with the vendor role to modify product variations belonging to other vendors, and to change the status and title of arbitra...