Veille CVE

Recherche « MultiVendorX »

12 CVE

Critique 0 Élevée 5 Moyenne 6 Faible 1 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « MultiVendorX » ✕
  1. CVE-2026-108695 7.1 Élevée

    MultiVendorX

    MultiVendorX WordPress plugin through 5.0.19 contains an incorrect authorization vulnerability that allows vendor accounts to modify marketplace-wide settings via the settings REST endpoint. Attackers with the store_owner role can send POST requests to /wp-json/multivendorx/v1/settings, gated only by edit_stores, to overwrite commission, payout, and onboarding settings.

  2. CVE-2026-12951 6.5 Moyenne

    wcmp MultiVendorX – WooCommerce Multivendor Marketplace AI Powered Solutions

    The Dc Woocommerce Multi Vendor plugin for WordPress is vulnerable to SQL Injection via the 'order_by' parameter of the /multivendorx/v1/compliance/report-abuse REST endpoint in versions up to and including 5.0.18. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query — the value is concatenated directly into an ORDER BY clause where esc_sql() (which only neutralizes characters needed to break out of quoted string literals) provides no protection. This makes it possible for authenticated attackers, with vendor-level access and above (users granted the 'edit_stores' capability), to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

  3. CVE-2026-74926 7.1 Élevée

    Unknown MultiVendorX

    The MultiVendorX WordPress plugin before 5.0.16 does not verify that a user owns the store they are acting on in one of its REST API routes, allowing any authenticated user, such as a subscriber, to overwrite any store's details and payout settings and to replace the record of who owns it.

  4. CVE-2026-74925 7.2 Élevée

    Unknown MultiVendorX

    The MultiVendorX WordPress plugin before 5.0.16 does not restrict who can update its role and capability settings, allowing users holding its vendor role to grant that role administrator-level capabilities and take over the site.

  5. CVE-2026-81792 6.5 Moyenne

    MultiVendorX Product Catalog Enquiry for WooCommerce by MultiVendorX

    Incorrect Privilege Assignment vulnerability in MultiVendorX Product Catalog Enquiry for WooCommerce by MultiVendorX woocommerce-catalog-enquiry allows Privilege Escalation.This issue affects Product Catalog Enquiry for WooCommerce by MultiVendorX: from n/a through 6.1.5.

  6. CVE-2026-74927 5.3 Moyenne

    Unknown MultiVendorX

    The MultiVendorX WordPress plugin before 5.0.15 does not have proper authorisation controls on one of its REST API listing routes, allowing unauthenticated users to retrieve vendor contact and payout details, pending payout amounts, and administrative notes attached to store applications.

  7. CVE-2026-66651 6.5 Moyenne

    MultiVendorX

    Missing Authorization vulnerability in MultiVendorX MultiVendorX dc-woocommerce-multi-vendor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MultiVendorX: from n/a through 5.0.20.

  8. CVE-2026-66441 7.5 Élevée

    MultiVendorX

    Unauthenticated Broken Access Control in MultiVendorX <= 5.0.10 versions.

  9. CVE-2026-16746 2.7 Faible

    Unknown MultiVendorX

    The MultiVendorX WordPress plugin before 5.0.11 does not verify that the requested store belongs to the current user in one of its REST API endpoints, allowing any vendor-level user to read other vendors' commission and financial data.

  10. CVE-2026-16605 7.2 Élevée

    Unknown MultiVendorX

    The MultiVendorX WordPress plugin before 5.0.11 does not verify that the store targeted through its REST API belongs to the requesting vendor, allowing an authenticated vendor (Store Owner and above) to view, take over, permanently delete, or modify any other vendor's store on the marketplace.

  11. CVE-2026-61945 6.5 Moyenne

    MultiVendorX WooCommerce Product Stock Alert

    Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in MultiVendorX WooCommerce Product Stock Alert allows Retrieve Embedded Sensitive Data. This issue affects WooCommerce Product Stock Alert: from n/a through 3.0.6.

  12. CVE-2026-12941 6.5 Moyenne

    wcmp MultiVendorX – WooCommerce Multivendor Marketplace AI Powered Solutions

    The MultiVendorX – WooCommerce Multivendor Marketplace AI Powered Solutions plugin for WordPress is vulnerable to generic SQL Injection via the 'order_by' parameter in all versions up to, and including, 5.0.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This vulnerability is exploitable by any authenticated subscriber-level user when the plugin's store approval setting is configured to automatically approve store owners (described as the default), as this allows any logged-in user to self-register as a store_owner via the public Stores REST endpoint, thereby obtaining the edit_stores capability required to reach the vulnerable transactions endpoint.