Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Release: MultiVendorX 5.0.11 Clear all filters
TI-2026-13945 CVE-2026-16746 · GHSA-xm3p-gghg-f4v9

MultiVendorX < 5.0.11 - Store Owner+ Cross-Store Commission Data Disclosure via commissions REST Endpoint

Priority LOW 13

The MultiVendorX WordPress plugin before 5.0.11 does not verify that the requested store belongs to the current user in one of its REST API endpoints, allowing any vendor-level user to read other vendors' commission and…

CVSS 3.1LOW 2.7 Network High privileges No interaction EPSS 0.00299 Published 2026-08-05 Fixed in 5.0.11 CWE-639
TI-2026-13856 CVE-2026-16605 · GHSA-w6w9-w293-w3m5

MultiVendorX < 5.0.11 - Store Owner+ Cross-Vendor Store Takeover and Deletion via Missing Authorization

Priority HIGH 67

The MultiVendorX WordPress plugin before 5.0.11 does not verify that the store targeted through its REST API belongs to the requesting vendor, allowing an authenticated vendor (Store Owner and above) to view, take over,…

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.00462 Published 2026-08-05 Fixed in 5.0.11 CWE-862