WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
dc-woocommerce-multi-vendor
Published
2023-09-12
Title
MultiVendorX < 4.0.26 - Improper Authorization on REST Routes via 'save_settings_permission'
Slug
dc-woocommerce-multi-vendor
Published
2023-12-26
Title
WC Marketplace < 4.0.24 - Missing Authorization via mvx_save_dashpages
Slug
dc-woocommerce-multi-vendor
Published
2024-01-31
Title
MultiVendorX Marketplace < 4.0.26 - Missing Authorization
Slug
dc-woocommerce-multi-vendor
Published
2024-03-28
Title
WC Marketplace < 4.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
dc-woocommerce-multi-vendor
Published
2024-04-05
Title
WC Marketplace < 4.1.4 - Missing Authorization
Slug
dc-woocommerce-multi-vendor
Published
2024-06-05
Title
MultiVendorX Marketplace – WooCommerce MultiVendor Marketplace Solution < 4.1.12 - Authenticated (Contributor+) Stored Cross-Site Scripting via hover_animation Parameter
Slug
dc-woocommerce-multi-vendor
Published
2024-08-09
Title
WC Marketplace < 4.2.0 - Reflected Cross-Site Scripting
Slug
dc-woocommerce-multi-vendor
Published
2024-09-03
Title
MultiVendorX – The Ultimate WooCommerce Multivendor Marketplace Solution < 4.2.1 - Missing Authorization to Limited Vendor Privilege Escalation/Account Takeover
Slug
dc-woocommerce-multi-vendor
Published
2024-10-23
Title
MultiVendorX – The Ultimate WooCommerce Multivendor Marketplace Solution < 4.2.5 - Cross-Site Request Forgery to Vendor Updates
Slug
dc-woocommerce-multi-vendor
Published
2024-10-23
Title
MultiVendorX – The Ultimate WooCommerce Multivendor Marketplace Solution < 4.2.5 - Missing Authorization to Forged Vendor Profile Deletion Email Sending
Slug
dc-woocommerce-multi-vendor
Published
2025-01-24
Title
WC Marketplace < 4.2.14 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
dc-woocommerce-multi-vendor
Published
2025-01-30
Title
MultiVendorX – The Ultimate WooCommerce Multivendor Marketplace Solution < 4.2.15 - Unauthenticated Limited Local File Inclusion
Slug
dc-woocommerce-multi-vendor
Published
2025-04-04
Title
MultiVendorX – The Ultimate WooCommerce Multivendor Marketplace Solution < 4.2.20 - Missing Authorization to Unauthenticated Table Rates Deletion
Slug
dc-woocommerce-multi-vendor
Published
2025-05-16
Title
MultiVendorX – WooCommerce Multivendor Marketplace Solutions < 4.2.23 - Incorrect Authorization to Authenticated (Contributor+) Arbitrary Post Deletion
Slug
dc-woocommerce-multi-vendor
Published
2025-05-19
Title
MultiVendorX < 4.2.23 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
dc-woocommerce-multi-vendor
Published
2025-06-04
Title
MultiVendorX < 4.2.23 - Unauthenticated Information Exposure
Slug
dc-woocommerce-multi-vendor
Published
2025-06-12
Title
MultiVendorX < 4.2.24 - Missing Authorization
Slug
dc-woocommerce-multi-vendor
Published
2026-08-07
Title
MultiVendorX – WooCommerce Multivendor Marketplace AI Powered Solutions < 5.0.11 - Missing Authorization
Slug
dc-woocommerce-multi-vendor
Published
2026-08-18
Title
MultiVendorX – WooCommerce Multivendor Marketplace AI Powered Solutions <= 5.0.15 - Missing Authorization
Slug
dc-woocommerce-multi-vendor
Published
2026-07-15
Title
MultiVendorX < 5.0.10 - Authenticated (Store Owner+) SQL Injection via 'order_by' Parameter
Slug
dc-woocommerce-multi-vendor
Published
2026-07-27
Title
MultiVendorX < 5.0.11 - Store Owner+ Cross-Vendor Store Takeover and Deletion via Missing Authorization
Slug
dc-woocommerce-multi-vendor
Published
2026-07-27
Title
MultiVendorX < 5.0.11 - Store Owner+ Cross-Store Commission Data Disclosure via commissions REST Endpoint
Slug
dc-woocommerce-multi-vendor
Published
2026-08-31
Title
MultiVendorX 5.0.13 - 5.0.14 - Unauthenticated Vendor PII and Payout Data Disclosure via stores REST Endpoint
Slug
dd-post-carousel
Published
2023-12-27
Title
Custom Post Carousels with Owl < 1.4.7 - Authenticated (Editor+) Stored Cross-Site Scripting
Slug
dd-post-carousel
Published
2025-05-30
Title
Custom Post Carousels with Owl < 1.4.12 - Contributor+ Stored XSS