Plugin icon

MultiVendorX – WooCommerce Multivendor Marketplace Solutions

dc-woocommerce-multi-vendor

Vulnerabilities:

25

Last Updated:

March 10, 2026

Active Installs:

3000

Published
Title
Fixed in
CVSS
Published
2025-06-12
Title
MultiVendorX < 4.2.24 - Missing Authorization
Fixed in
Fixed in 4.2.24
CVSS
5.3 (medium)
Published
2025-06-04
Title
MultiVendorX < 4.2.23 - Unauthenticated Information Exposure
Fixed in
Fixed in 4.2.23
CVSS
5.3 (medium)
Published
2025-05-19
Title
MultiVendorX < 4.2.23 - Authenticated (Contributor+) Stored Cross-Site Scripting
Fixed in
Fixed in 4.2.23
CVSS
6.4 (medium)
Published
2025-05-16
Title
MultiVendorX – WooCommerce Multivendor Marketplace Solutions < 4.2.23 - Incorrect Authorization to Authenticated (Contributor+) Arbitrary Post Deletion
Fixed in
Fixed in 4.2.23
CVSS
4.3 (medium)
Published
2025-04-04
Title
MultiVendorX – The Ultimate WooCommerce Multivendor Marketplace Solution < 4.2.20 - Missing Authorization to Unauthenticated Table Rates Deletion
Fixed in
Fixed in 4.2.20
CVSS
5.3 (medium)
Published
2025-01-30
Title
MultiVendorX – The Ultimate WooCommerce Multivendor Marketplace Solution < 4.2.15 - Unauthenticated Limited Local File Inclusion
Fixed in
Fixed in 4.2.15
CVSS
9.8 (critical)
Published
2025-01-24
Title
WC Marketplace < 4.2.14 - Authenticated (Contributor+) Stored Cross-Site Scripting
Fixed in
Fixed in 4.2.14
CVSS
6.4 (medium)
Published
2024-10-23
Title
MultiVendorX – The Ultimate WooCommerce Multivendor Marketplace Solution < 4.2.5 - Cross-Site Request Forgery to Vendor Updates
Fixed in
Fixed in 4.2.5
CVSS
6.3 (medium)
Published
2024-10-23
Title
MultiVendorX – The Ultimate WooCommerce Multivendor Marketplace Solution < 4.2.5 - Missing Authorization to Forged Vendor Profile Deletion Email Sending
Fixed in
Fixed in 4.2.5
CVSS
4.3 (medium)
Published
2024-09-03
Title
MultiVendorX – The Ultimate WooCommerce Multivendor Marketplace Solution < 4.2.1 - Missing Authorization to Limited Vendor Privilege Escalation/Account Takeover
Fixed in
Fixed in 4.2.1
CVSS
9.8 (critical)
Published
2024-08-09
Title
WC Marketplace < 4.2.0 - Reflected Cross-Site Scripting
Fixed in
Fixed in 4.2.0
CVSS
7.1 (high)
Published
2024-06-05
Title
MultiVendorX Marketplace – WooCommerce MultiVendor Marketplace Solution < 4.1.12 - Authenticated (Contributor+) Stored Cross-Site Scripting via hover_animation Parameter
Fixed in
Fixed in 4.1.12
CVSS
6.4 (medium)
Published
2024-04-05
Title
WC Marketplace < 4.1.4 - Missing Authorization
Fixed in
Fixed in 4.1.4
CVSS
4.3 (medium)
Published
2024-03-28
Title
WC Marketplace < 4.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
Fixed in
Fixed in 4.1.4
CVSS
6.4 (medium)
Published
2024-01-31
Title
MultiVendorX Marketplace < 4.0.26 - Missing Authorization
Fixed in
Fixed in 4.0.26
CVSS
8.6 (high)
Published
2023-12-26
Title
WC Marketplace < 4.0.24 - Missing Authorization via mvx_save_dashpages
Fixed in
Fixed in 4.0.24
CVSS
7.5 (high)
Published
2023-09-12
Title
MultiVendorX < 4.0.26 - Improper Authorization on REST Routes via 'save_settings_permission'
Fixed in
Fixed in 4.0.26
CVSS
8.6 (high)
Published
2022-08-15
Title
Multivendor Marketplace Solution for WooCommerce < 3.8.12 - Unauthorised AJAX Calls
Fixed in
Fixed in 3.8.12
CVSS
7.6 (high)
Published
2022-08-15
Title
Multivendor Marketplace Solution for WooCommerce < 3.8.12 - Unauthenticated LFI
Fixed in
Fixed in 3.8.12
CVSS
4.8 (medium)
Published
2022-08-15
Title
Multivendor Marketplace Solution for WooCommerce < 3.8.12 - Multiple Reflected Cross-Site Scripting
Fixed in
Fixed in 3.8.12
CVSS
6.5 (medium)
Published
2021-12-06
Title
Multivendor Marketplace Solution for WooCommerce < 3.8.4 - Reflected Cross-Site Scripting
Fixed in
Fixed in 3.8.4
CVSS
7.5 (high)
Published
2021-06-08
Title
CSRF Bypass in Multiple Plugins
Fixed in
Fixed in 3.7.4
CVSS
5.4 (medium)
Published
2021-05-26
Title
Multivendor Marketplace Solution for WooCommerce < 3.7.4 - Unauthenticated Arbitrary Product Comment
Fixed in
Fixed in 3.7.4
CVSS
5.3 (medium)
Published
2020-09-16
Title
MultiVendorX < 3.5.8 - Cross-Site Request Forgery
Fixed in
Fixed in 3.5.8
CVSS
4.3 (medium)
Published
2020-09-16
Title
Multiple Plugins/Themes - Cross-Site Request Forgery (CSRF)
Fixed in
Fixed in 3.5.8
CVSS
5.4 (medium)