Multivendorx
Monthly
Privilege escalation in MultiVendorX WordPress plugin before 5.0.16 allows authenticated vendor-role users to grant administrator-level WordPress capabilities to the vendor role, enabling full site takeover. The plugin's role and capability settings update mechanism fails to enforce access boundaries, letting any vendor - a legitimately registered but low-privileged marketplace seller - rewrite role permissions without restriction. A publicly available exploit exists via WPScan, and the vendor has released a patch in version 5.0.16.
Unauthenticated broken access control in the MultiVendorX WordPress plugin (versions 5.0.10 and earlier) exposes restricted marketplace data to any remote attacker without credentials. The flaw stems from missing authorization checks (CWE-862) on one or more plugin endpoints, allowing unauthenticated network requests to bypass access restrictions and retrieve sensitive information such as vendor orders, customer data, or marketplace configurations. No public exploit or CISA KEV listing has been identified at time of analysis, but the low attack complexity and zero-authentication requirement make this a straightforward target for opportunistic scanning.
Broken object-level authorization in the MultiVendorX WordPress plugin before 5.0.11 allows any authenticated vendor (Store Owner role or above) to perform unauthorized cross-tenant operations against other vendors' stores via the REST API. The plugin fails to verify that the target store in a REST API request belongs to the authenticated vendor, enabling confidentiality breaches, store takeovers, permanent deletion, and arbitrary modification of competitor or co-platform stores. A publicly available exploit exists; EPSS probability is low (0.14%, 4th percentile) suggesting opportunistic or targeted exploitation rather than mass scanning, and this CVE is not currently listed in the CISA KEV catalog.
Unauthenticated privilege escalation in the Product Catalog Enquiry for WooCommerce by MultiVendorX WordPress plugin (versions <= 6.1.4) permits remote unauthenticated attackers to invoke restricted plugin functionality without holding any site credentials. The root cause is incorrect privilege assignment (CWE-266), where specific plugin endpoints fail to enforce proper capability checks before executing sensitive actions. No public exploit has been identified at time of analysis and the CVE does not appear in CISA KEV; however, the zero-authentication, low-complexity network vector makes automated scanning and opportunistic abuse straightforward against any WooCommerce site running the affected plugin.
Unauthenticated information disclosure in the MultiVendorX WordPress plugin (versions prior to 5.0.15) exposes sensitive marketplace data through an improperly secured REST API listing route. Any unauthenticated remote attacker can query the endpoint to retrieve vendor contact information, payout details, pending payout amounts, and administrative notes attached to store applications. A publicly available exploit code exists via WPScan, and a vendor patch has been released in version 5.0.15.
Broken access control in the MultiVendorX WordPress plugin (versions ≤ 5.0.14) allows unauthenticated remote attackers to bypass authorization checks and perform actions or access data restricted to authorized users. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms exploitation requires no credentials, no special configuration, and no user interaction, making it trivially reachable from the network against any WordPress/WooCommerce site running the affected plugin. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Insecure Direct Object Reference (IDOR) in the MultiVendorX WordPress plugin before 5.0.11 exposes confidential financial and commission data across vendor accounts. Any authenticated vendor-level user can query a REST API endpoint using an arbitrary store identifier to retrieve another vendor's earnings and commission records, bypassing per-store ownership validation entirely. No active exploitation is confirmed in CISA KEV, but a publicly available exploit exists per WPScan, and the low EPSS score (0.14%, 4th percentile) suggests limited opportunistic scanning activity at this time.
CVE-2025-48261 is an information disclosure vulnerability in MultiVendorX that allows unauthenticated remote attackers to retrieve sensitive data embedded within sent data through a network-accessible interface. The vulnerability affects MultiVendorX versions up to and including 4.2.22, with a CVSS score of 7.5 indicating high confidentiality impact. While no active KEV or public POC details were provided in the available intelligence, the network-accessible attack vector (AV:N) and lack of privilege requirements (PR:N) make this a material risk for exposed instances.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MultiVendorX MultiVendorX allows Stored XSS.2.22. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The MultiVendorX - WooCommerce Multivendor Marketplace Solutions plugin for WordPress is vulnerable to unauthorized loss of data due to a misconfigured capability check on the 'delete_fpm_product'. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. This Incorrect Authorization vulnerability could allow attackers to bypass authorization checks to access restricted resources.
The MultiVendorX - Empower Your WooCommerce Store with a Dynamic Multivendor Marketplace - Build the Next Amazon, eBay, Etsy plugin for WordPress is vulnerable to unauthorized loss of data due to a. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The MultiVendorX - The Ultimate WooCommerce Multivendor Marketplace Solution plugin for WordPress is vulnerable to Limited Local File Inclusion in all versions up to, and including, 4.2.14 via the. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The MultiVendorX - The Ultimate WooCommerce Multivendor Marketplace Solution plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.2.4. Rated medium severity (CVSS 6.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Request Forgery (CSRF) vulnerability could allow attackers to trick authenticated users into performing unintended actions.
The MultiVendorX - The Ultimate WooCommerce Multivendor Marketplace Solution plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The MultiVendorX - The Ultimate WooCommerce Multivendor Marketplace Solution plugin for WordPress is vulnerable to privilege escalation/de-escalation and account takeover due to an insufficient. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Missing Authorization vulnerability in MultiVendorX WC Marketplace.1.3. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Missing Authorization vulnerability in MultiVendorX Product Catalog Enquiry for WooCommerce by MultiVendorX.0.5. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The MultiVendorX Marketplace - WooCommerce MultiVendor Marketplace Solution plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘hover_animation’ parameter in all versions up. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
The Product Catalog Mode For WooCommerce WordPress plugin before 5.0.3 does not properly authorize settings updates or escape settings values, leading to stored XSS by unauthenticated users. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in MultiVendorX Product Stock Manager & Notifier for WooCommerce.0.1. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The MultiVendorX plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.5.7. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Privilege escalation in MultiVendorX WordPress plugin before 5.0.16 allows authenticated vendor-role users to grant administrator-level WordPress capabilities to the vendor role, enabling full site takeover. The plugin's role and capability settings update mechanism fails to enforce access boundaries, letting any vendor - a legitimately registered but low-privileged marketplace seller - rewrite role permissions without restriction. A publicly available exploit exists via WPScan, and the vendor has released a patch in version 5.0.16.
Unauthenticated broken access control in the MultiVendorX WordPress plugin (versions 5.0.10 and earlier) exposes restricted marketplace data to any remote attacker without credentials. The flaw stems from missing authorization checks (CWE-862) on one or more plugin endpoints, allowing unauthenticated network requests to bypass access restrictions and retrieve sensitive information such as vendor orders, customer data, or marketplace configurations. No public exploit or CISA KEV listing has been identified at time of analysis, but the low attack complexity and zero-authentication requirement make this a straightforward target for opportunistic scanning.
Broken object-level authorization in the MultiVendorX WordPress plugin before 5.0.11 allows any authenticated vendor (Store Owner role or above) to perform unauthorized cross-tenant operations against other vendors' stores via the REST API. The plugin fails to verify that the target store in a REST API request belongs to the authenticated vendor, enabling confidentiality breaches, store takeovers, permanent deletion, and arbitrary modification of competitor or co-platform stores. A publicly available exploit exists; EPSS probability is low (0.14%, 4th percentile) suggesting opportunistic or targeted exploitation rather than mass scanning, and this CVE is not currently listed in the CISA KEV catalog.
Unauthenticated privilege escalation in the Product Catalog Enquiry for WooCommerce by MultiVendorX WordPress plugin (versions <= 6.1.4) permits remote unauthenticated attackers to invoke restricted plugin functionality without holding any site credentials. The root cause is incorrect privilege assignment (CWE-266), where specific plugin endpoints fail to enforce proper capability checks before executing sensitive actions. No public exploit has been identified at time of analysis and the CVE does not appear in CISA KEV; however, the zero-authentication, low-complexity network vector makes automated scanning and opportunistic abuse straightforward against any WooCommerce site running the affected plugin.
Unauthenticated information disclosure in the MultiVendorX WordPress plugin (versions prior to 5.0.15) exposes sensitive marketplace data through an improperly secured REST API listing route. Any unauthenticated remote attacker can query the endpoint to retrieve vendor contact information, payout details, pending payout amounts, and administrative notes attached to store applications. A publicly available exploit code exists via WPScan, and a vendor patch has been released in version 5.0.15.
Broken access control in the MultiVendorX WordPress plugin (versions ≤ 5.0.14) allows unauthenticated remote attackers to bypass authorization checks and perform actions or access data restricted to authorized users. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms exploitation requires no credentials, no special configuration, and no user interaction, making it trivially reachable from the network against any WordPress/WooCommerce site running the affected plugin. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Insecure Direct Object Reference (IDOR) in the MultiVendorX WordPress plugin before 5.0.11 exposes confidential financial and commission data across vendor accounts. Any authenticated vendor-level user can query a REST API endpoint using an arbitrary store identifier to retrieve another vendor's earnings and commission records, bypassing per-store ownership validation entirely. No active exploitation is confirmed in CISA KEV, but a publicly available exploit exists per WPScan, and the low EPSS score (0.14%, 4th percentile) suggests limited opportunistic scanning activity at this time.
CVE-2025-48261 is an information disclosure vulnerability in MultiVendorX that allows unauthenticated remote attackers to retrieve sensitive data embedded within sent data through a network-accessible interface. The vulnerability affects MultiVendorX versions up to and including 4.2.22, with a CVSS score of 7.5 indicating high confidentiality impact. While no active KEV or public POC details were provided in the available intelligence, the network-accessible attack vector (AV:N) and lack of privilege requirements (PR:N) make this a material risk for exposed instances.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MultiVendorX MultiVendorX allows Stored XSS.2.22. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The MultiVendorX - WooCommerce Multivendor Marketplace Solutions plugin for WordPress is vulnerable to unauthorized loss of data due to a misconfigured capability check on the 'delete_fpm_product'. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. This Incorrect Authorization vulnerability could allow attackers to bypass authorization checks to access restricted resources.
The MultiVendorX - Empower Your WooCommerce Store with a Dynamic Multivendor Marketplace - Build the Next Amazon, eBay, Etsy plugin for WordPress is vulnerable to unauthorized loss of data due to a. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The MultiVendorX - The Ultimate WooCommerce Multivendor Marketplace Solution plugin for WordPress is vulnerable to Limited Local File Inclusion in all versions up to, and including, 4.2.14 via the. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The MultiVendorX - The Ultimate WooCommerce Multivendor Marketplace Solution plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.2.4. Rated medium severity (CVSS 6.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Request Forgery (CSRF) vulnerability could allow attackers to trick authenticated users into performing unintended actions.
The MultiVendorX - The Ultimate WooCommerce Multivendor Marketplace Solution plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The MultiVendorX - The Ultimate WooCommerce Multivendor Marketplace Solution plugin for WordPress is vulnerable to privilege escalation/de-escalation and account takeover due to an insufficient. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Missing Authorization vulnerability in MultiVendorX WC Marketplace.1.3. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Missing Authorization vulnerability in MultiVendorX Product Catalog Enquiry for WooCommerce by MultiVendorX.0.5. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The MultiVendorX Marketplace - WooCommerce MultiVendor Marketplace Solution plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘hover_animation’ parameter in all versions up. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
The Product Catalog Mode For WooCommerce WordPress plugin before 5.0.3 does not properly authorize settings updates or escape settings values, leading to stored XSS by unauthenticated users. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in MultiVendorX Product Stock Manager & Notifier for WooCommerce.0.1. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The MultiVendorX plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.5.7. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.