MultiVendorX – WooCommerce Multivendor Marketplace AI Powered Solutions

Уязвимости

• CVE-2025-0493без авторизации≤ 4.2.14

  MultiVendorX – The Ultimate WooCommerce Multivendor Marketplace Solution <= 4.2.14 - Unauthenticated Limited Local File Inclusion

  Критич. 9.8

• CVE-2024-8289без авторизации≤ 4.2.0

  MultiVendorX – The Ultimate WooCommerce Multivendor Marketplace Solution <= 4.2.0 - Missing Authorization to Limited Vendor Privilege Escalation/Account Takeove

  Критич. 9.8

• CVE-2024-31304нужен вход≤ 4.1.3

  WordPress MultiVendorX Marketplace <= 4.1.3 - Broken Access Control vulnerability

  Высокий 8.8

• CVE-2025-49916без авторизации≤ 4.2.23

  WordPress MultiVendorX plugin <= 4.2.23 - Broken Access Control vulnerability

  Высокий 8.6

• CVE-2024-24703без авторизации≤ 4.0.25

  WordPress MultiVendorX plugin <= 4.0.25 - Broken Access Control vulnerability

  Высокий 8.6

• CVE-2023-51355без авторизации≤ 4.0.23

  WordPress MultiVendorX plugin <= 4.0.23 - Broken Access Control vulnerability

  Высокий 8.2

• CVE-2026-66441без авторизации≤ 5.0.10

  WordPress MultiVendorX plugin <= 5.0.10 - Broken Access Control vulnerability

  Высокий 7.5

• CVE-2025-48261без авторизации≤ 4.2.22

  WordPress MultiVendorX plugin <= 4.2.22 - Sensitive Data Exposure Vulnerability

  Высокий 7.5

• CVE-2024-43213без авторизации · нужен клик≤ 4.1.17

  WordPress MultiVendorX Marketplace plugin <= 4.1.17 - Reflected Cross Site Scripting (XSS) vulnerability

  Высокий 7.1

• CVE-2026-66651без авторизацииисправления нет

  WordPress MultiVendorX plugin <= 5.0.19 - Broken Access Control vulnerability

  Средний 6.5

• CVE-2025-2789без авторизации≤ 4.2.19

  MultiVendorX – The Ultimate WooCommerce Multivendor Marketplace Solution <= 4.2.19 - Missing Authorization to Unauthenticated Table Rates Deletion

  Средний 6.5

• CVE-2026-12951нужен вход≤ 5.0.18

  MultiVendorX <= 5.0.18 - Authenticated (Store Manager+) SQL Injection via 'order_by' Parameter

  Средний 6.5

• CVE-2026-12941подписчик+≤ 5.0.9

  MultiVendorX <= 5.0.9 - Authenticated (Store Owner+) SQL Injection via 'order_by' Parameter

  Средний 6.5

• CVE-2025-24706нужен вход≤ 4.2.13

  WordPress MultiVendorX plugin <= 4.2.13 - Cross Site Scripting (XSS) vulnerability

  Средний 6.5

• CVE-2024-30433нужен вход≤ 4.1.3

  WordPress MultiVendorX Marketplace plugin <= 4.1.3 - Cross Site Scripting (XSS) vulnerability

  Средний 6.5

• CVE-2024-9943без авторизации · нужен клик≤ 4.2.4

  MultiVendorX – The Ultimate WooCommerce Multivendor Marketplace Solution <= 4.2.4 - Cross-Site Request Forgery to Vendor Updates

  Средний 6.3

• CVE-2025-48263нужен вход≤ 4.2.22

  WordPress MultiVendorX plugin <= 4.2.22 - Cross Site Scripting (XSS) Vulnerability

  Средний 5.4

• CVE-2024-5259участник+≤ 4.1.11

  MultiVendorX Marketplace – WooCommerce MultiVendor Marketplace Solution <= 4.1.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via hover_animation

  Средний 5.4

• CVE-2020-36741без авторизации · нужен клик→ 3.5.8

  MultiVendorX – MultiVendor Marketplace Solution For WooCommerce <= 3.5.7 - Cross-Site Request Forgery Bypass

  Средний 4.3

• CVE-2024-9531подписчик+≤ 4.2.4

  MultiVendorX – The Ultimate WooCommerce Multivendor Marketplace Solution <= 4.2.4 - Missing Authorization to Forged Vendor Profile Deletion Email Sending

  Средний 4.3

• CVE-2025-4101участник+≤ 4.2.22

  MultiVendorX – WooCommerce Multivendor Marketplace Solutions <= 4.2.22 - Incorrect Authorization to Authenticated (Contributor+) Arbitrary Post Deletion

  Средний 4.3