These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
CVE-2026-108695 MultiVendorX through 5.0.19 contains an incorrect authorization vulnerability via the settings REST endpoint, allowing vendor accounts to modify marketplace-wide settings. Defenders should assess exposure and verify setting integrity to prevent unauthorized changes. This vulnerability has a high severity with a CVSS score of 7.1 and affects WordPress installations with the MultiVendorX plu [truncated]
The MultiVendorX WordPress plugin before 5.0.16 does not restrict who can update its role and capability settings, allowing users holding its vendor role to grant that role administrator-level capabilities and take over the site. This vulnerability allows users with the vendor role to escalate their privileges, potentially leading to site takeover. Defenders should assess exposure and prioritize remediati [truncated]
CVE-2026-81792 is a medium-severity vulnerability in the Product Catalog Enquiry for WooCommerce by MultiVendorX plugin, affecting versions up to 6.1.4. The vulnerability allows unauthenticated privilege escalation.
The MultiVendorX WordPress plugin before 5.0.15 has a vulnerability allowing unauthenticated users to retrieve sensitive information via a REST API listing route. This issue has a CVSS score of 5.3 and is classified as MEDIUM severity. The vulnerability exists due to a lack of proper authorization controls on one of its REST API listing routes, which allows access to vendor contact and payout details, pen [truncated]
A Missing Authorization vulnerability in MultiVendorX dc-woocommerce-multi-vendor plugin affects versions from n/a through 5.0.18. This issue allows attackers to exploit incorrectly configured access control security levels. The vulnerability impacts MultiVendorX dc-woocommerce-multi-vendor plugin installations, potentially allowing unauthorized access or exploitation of incorrectly configured access cont [truncated]
The MultiVendorX WordPress plugin before 5.0.11 has a REST API endpoint vulnerability. This allows vendor-level users unauthorized access to financial data of other vendors due to inadequate authorization checks. The issue arises from the plugin's failure to verify that the requested store belongs to the current user. Consequently, any vendor-level user can potentially read other vendors' commission and f [truncated]
CVE-2026-61945 is an Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in MultiVendorX WooCommerce Product Stock Alert. The issue allows retrieval of embedded sensitive data and affects WooCommerce Product Stock Alert versions from n/a through 3.0.6. This vulnerability has a medium severity and defenders should assess exposure and verify potential data retrieval in W [truncated]
