MultiVendorX CVE-2026-114711

Exploitation requires an authenticated account at subscriber privilege level (PR:L) on the target WordPress site - practical for a marketplace plugin that commonly permits open customer/vendor registration - and requires user interaction (UI:R): a victim must view the attacker-supplied content for the injected script to execute. The scope change (S:C) indicates execution in a different security context, typically a higher-privileged user's browser. Limiting factors: the attacker cannot act fully unauthenticated, a victim must be enticed to view the payload, and only sites running MultiVendorX <= 5.0.20 are affected. The specific vulnerable feature, input field, or parameter is not described in the available sources.

This is a moderate-severity stored/subscriber Cross-Site Scripting flaw (CVSS 6.5) in the MultiVendorX WordPress plugin at or below version 5.0.20, reported by Patchstack. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L shows network reach and low complexity, but two factors meaningfully blunt real-world risk: PR:L means the attacker must already hold a valid low-privilege (subscriber) account on the target site, and UI:R means a victim must interact with the injected payload. The scope change (S:C) reflects that script executes in another user's/admin's browser context, which is the primary leverage here. No EPSS score, KEV listing, or SSVC automatable/technical-impact fields were supplied, and there is no confirmed proof-of-concept - the only reference is a Patchstack database entry, not working exploit code. The vuln.today priority is 'this_month,' consistent with a patch-on-normal-cycle issue rather than an emergency. In short: a genuine but not top-tier priority. It is a credible risk for sites that allow open subscriber/customer registration (common for a multi-vendor marketplace plugin), but the authentication and user-interaction requirements make it a targeted-abuse scenario rather than mass, unauthenticated compromise.

An attacker registers or already holds a subscriber-level account on a WordPress site running a vulnerable MultiVendorX version and submits input containing a malicious script payload through an affected plugin field. When a higher-privileged user such as an administrator or vendor later views that content in their browser, the script executes in their session context (scope change), potentially enabling session/action abuse. No public exploit code is identified at time of analysis; the only reference is a Patchstack advisory entry.