WordPress Vulnerability Scanner WPSec
Vulnerabilities / MultiVendorX

MultiVendorX vulnerabilities

Advisories WPSec published for MultiVendorX – WooCommerce Multivendor Marketplace AI Powered Solutions. Other sources may list more. Its attack surface: MultiVendorX on WPSec AttackSurface.

PublishedIDVulnerabilitySeverityFixed in
2026-10-13 WPSEC-2026-0851 MultiVendorX <= 5.0.19 - Authenticated (Store Owner+) Missing Authorization to Global Settings Update via REST API Medium 4.3 5.0.20
2026-10-01 WPSEC-2026-0115 MultiVendorX <= 5.0.18 - Authenticated (Subscriber+) Missing Authorization to Marketplace-Wide WooCommerce REST API Access High 8.8 5.0.19
2026-10-01 WPSEC-2026-0114 MultiVendorX <= 5.0.18 - Authenticated (Store Owner+) Missing Authorization to Withdrawal Approval and Balance Bypass Medium 6.5 5.0.19
2026-10-01 WPSEC-2026-0113 MultiVendorX <= 5.0.18 - Authenticated (Store Owner+) Missing Authorization to Marketplace Module Activation and Deactivation Medium 5.4 5.0.19
2026-10-01 WPSEC-2026-0112 MultiVendorX <= 5.0.18 - Authenticated (Customer+) Insecure Direct Object Reference to Refund Request on Arbitrary Orders Medium 4.3 5.0.19
2026-10-01 WPSEC-2026-0111 MultiVendorX <= 5.0.18 - Authenticated (Subscriber+) Privilege Escalation via Store REST Endpoint Admin-Only Fields Medium 6.5 5.0.19
2026-10-01 WPSEC-2026-0110 MultiVendorX <= 5.0.18 - Authenticated (Store Owner+) Cross-Store Follower Information Disclosure via FollowStore REST Endpoint Medium 4.3 5.0.19

License: CC BY 4.0