Multivendorx (Unknown) - vulnerabilities (CVEs)

5 CVEs, 0 in the last 30 days, 1 known versions, newest CVE from 2026-09-16. Vendor: Unknown.

CVEs of Multivendorx

• CVE-2026-74926 - CVSS 7.1 (high), 2026-09-16: The MultiVendorX WordPress plugin before 5.0.16 does not verify that a user owns the store they are acting on in one of its REST API routes, allowing any…
• CVE-2026-74925 - CVSS 7.2 (high), 2026-09-11: The MultiVendorX WordPress plugin before 5.0.16 does not restrict who can update its role and capability settings, allowing users holding its vendor role to…
• CVE-2026-74927 - CVSS 5.3 (medium), 2026-09-02: The MultiVendorX WordPress plugin before 5.0.15 does not have proper authorisation controls on one of its REST API listing routes, allowing unauthenticated…
• CVE-2026-16746 - CVSS 2.7 (low), 2026-08-05: The MultiVendorX WordPress plugin before 5.0.11 does not verify that the requested store belongs to the current user in one of its REST API endpoints,…
• CVE-2026-16605 - CVSS 7.2 (high), 2026-08-05: The MultiVendorX WordPress plugin before 5.0.11 does not verify that the store targeted through its REST API belongs to the requesting vendor, allowing an…