VulnCrest
Search
Create account
Report an incident
Radar sectionsPlugins & themes
Check my site

WordPress plugin

MultiVendorX – WooCommerce Multivendor Marketplace AI Powered Solutions security & vulnerabilities

dc-woocommerce-multi-vendor— active installsLast vulnerability Oct 30, 2026

Unpatched vulnerability in the latest version

At least one vulnerability affects the latest version and no fix has been released. Deactivate the plugin or restrict access to the affected feature until the vendor ships a patch.

Watch plugin
36Known vulnerabilities
  • Critical2
  • High7
  • Medium27
  • Low0
Vulnerabilities per year
2020: 1 vulnerability1202021: 2 vulnerabilities2212022: 4 vulnerabilities4222023: 2 vulnerabilities2232024: 9 vulnerabilities9242025: 7 vulnerabilities7252026: 11 vulnerabilities1126

All MultiVendorX – WooCommerce Multivendor Marketplace AI Powered Solutions vulnerabilities

MultiVendorX – WooCommerce Multivendor Marketplace AI Powered Solutions vulnerabilities
SeverityVulnerabilityCVEPublished
Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
≤5.0.20Update to 5.0.21
CVE-2026-114711
Medium4.3Missing Authorization
≤5.0.19No patch available
CVE-2026-108695
Medium6.5Authenticated (Store Manager+) SQL Injection via 'order_by' Parameter
≤5.0.18Update to 5.0.19
CVE-2026-12951
Medium4.3Missing Authorization
≤5.0.15Update to 5.0.16
CVE-2026-74926
Medium6.35.0.15 - Authenticated (Custom Role+) Privilege Escalation
5.0.0 – 5.0.15Update to 5.0.16
CVE-2026-74925
Medium5.35.0.14 - Unauthenticated Information Exposure
5.0.13 – 5.0.14Update to 5.0.15
CVE-2026-74927
Medium5.3Missing Authorization
≤5.0.17No patch available
CVE-2026-66651
Medium5.3Missing Authorization
≤5.0.10Update to 5.0.11
CVE-2026-66441
Medium4.3Missing Authorization
<5.0.11Update to 5.0.11
CVE-2026-16605
Medium4.3Insecure Direct Object Reference to Authenticated (Store Owner+) Cross-Store Commission Data Disclosure
≤5.0.10Update to 5.0.11
CVE-2026-16746
Medium6.5Authenticated (Store Owner+) SQL Injection via 'order_by' Parameter
≤5.0.9Update to 5.0.10
CVE-2026-12941
Medium5.3Missing Authorization
≤4.2.23Update to 4.2.24
CVE-2025-49916
Medium5.3Unauthenticated Information Exposure
≤4.2.22Update to 4.2.23
CVE-2025-48261
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤4.2.22Update to 4.2.23
CVE-2025-48263
Medium4.3Incorrect Authorization to Authenticated (Contributor+) Arbitrary Post Deletion
≤4.2.22Update to 4.2.23
CVE-2025-4101
Medium5.3Missing Authorization to Unauthenticated Table Rates Deletion
≤4.2.19Update to 4.2.20
CVE-2025-2789
Critical9.8Unauthenticated Limited Local File Inclusion
≤4.2.14Update to 4.2.15
CVE-2025-0493
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤4.2.13Update to 4.2.14
CVE-2025-24706
Medium4.3Missing Authorization to Forged Vendor Profile Deletion Email Sending
≤4.2.4Update to 4.2.5
CVE-2024-9531
Medium6.3Cross-Site Request Forgery to Vendor Updates
≤4.2.4Update to 4.2.5
CVE-2024-9943
High7.5Missing Authorization to Arbitrary Vendor Deletion
≤4.2.0Update to 4.2.1
CVE-2024-8289
Critical9.8Missing Authorization to Limited Vendor Privilege Escalation/Account Takeover
≤4.2.0Update to 4.2.1
—
Medium6.1Reflected Cross-Site Scripting
≤4.1.17Update to 4.2.0
CVE-2024-43213
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via hover_animation Parameter
≤4.1.11Update to 4.1.12
CVE-2024-5259
Medium4.3Missing Authorization
≤4.1.3Update to 4.1.4
CVE-2024-31304
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤4.1.3Update to 4.1.4
CVE-2024-30433
High8.6Missing Authorization
≤4.0.25Update to 4.0.26
CVE-2024-24703
High7.5Missing Authorization via mvx_save_dashpages
≤4.0.23Update to 4.0.24
CVE-2023-51355
High8.6Improper Authorization on REST Routes via 'save_settings_permission'
<4.0.26Update to 4.0.26
—
High7.3Multiple Unprotected AJAX Actions
≤3.8.11.8Update to 3.8.12
CVE-2022-2657
High8.2Local File Inclusion
≤3.8.11.8Update to 3.8.12
—
Medium6.1Reflected Cross-Site Scripting
≤3.8.11.8Update to 3.8.12
—
High8.8Cross-Site Request Forgery
≤3.8.11.8Update to 3.8.12
—
Medium6.1Reflected Cross-Site Scripting
<3.8.4Update to 3.8.4
—
Medium4.3Insecure Direct Object Reference
≤3.7.3Update to 3.7.4
—
Medium4.3Cross-Site Request Forgery Bypass
<3.5.8Update to 3.5.8
CVE-2020-36741

MultiVendorX – WooCommerce Multivendor Marketplace AI Powered Solutions: common questions

Does MultiVendorX – WooCommerce Multivendor Marketplace AI Powered Solutions have known vulnerabilities?

Yes. VulnCrest Radar lists 36 known vulnerabilities in MultiVendorX – WooCommerce Multivendor Marketplace AI Powered Solutions: 2 critical, 7 high, 27 medium. At least one is not fixed in the latest version.

How do I check which version of MultiVendorX – WooCommerce Multivendor Marketplace AI Powered Solutions I run?

In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.

What is the most recent MultiVendorX – WooCommerce Multivendor Marketplace AI Powered Solutions vulnerability?

CVE-2026-114711, published Oct 30, 2026: MultiVendorX – WooCommerce Multivendor Marketplace AI Powered Solutions <= 5.0.20 - Authenticated (Subscriber+) Stored Cross-Site Scripting. Severity: Medium (CVSS 6.4).

Is any MultiVendorX – WooCommerce Multivendor Marketplace AI Powered Solutions vulnerability listed in CISA KEV?

No. None of the known MultiVendorX – WooCommerce Multivendor Marketplace AI Powered Solutions vulnerabilities is currently listed in the CISA KEV catalog.

Search VulnCrest Radar

Jump to

Are you sure?