Veille CVE

Recherche « Unknown MultiVendorX »

5 CVE

Critique 0 Élevée 3 Moyenne 1 Faible 1 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « Unknown MultiVendorX » ✕
  1. CVE-2026-74926 7.1 Élevée

    Unknown MultiVendorX

    The MultiVendorX WordPress plugin before 5.0.16 does not verify that a user owns the store they are acting on in one of its REST API routes, allowing any authenticated user, such as a subscriber, to overwrite any store's details and payout settings and to replace the record of who owns it.

  2. CVE-2026-74925 7.2 Élevée

    Unknown MultiVendorX

    The MultiVendorX WordPress plugin before 5.0.16 does not restrict who can update its role and capability settings, allowing users holding its vendor role to grant that role administrator-level capabilities and take over the site.

  3. CVE-2026-74927 5.3 Moyenne

    Unknown MultiVendorX

    The MultiVendorX WordPress plugin before 5.0.15 does not have proper authorisation controls on one of its REST API listing routes, allowing unauthenticated users to retrieve vendor contact and payout details, pending payout amounts, and administrative notes attached to store applications.

  4. CVE-2026-16746 2.7 Faible

    Unknown MultiVendorX

    The MultiVendorX WordPress plugin before 5.0.11 does not verify that the requested store belongs to the current user in one of its REST API endpoints, allowing any vendor-level user to read other vendors' commission and financial data.

  5. CVE-2026-16605 7.2 Élevée

    Unknown MultiVendorX

    The MultiVendorX WordPress plugin before 5.0.11 does not verify that the store targeted through its REST API belongs to the requesting vendor, allowing an authenticated vendor (Store Owner and above) to view, take over, permanently delete, or modify any other vendor's store on the marketplace.