Skip to content
Founder-led WordPress incident response and care Request an assessment
3zerodigital Request a Website Assessment

Plugin security history

MultiVendorX – WooCommerce Multivendor Marketplace AI Powered Solutions Vulnerability History & Security Timeline

The Wordfence Intelligence dataset currently contains 26 vulnerability records associated with MultiVendorX – WooCommerce Multivendor Marketplace AI Powered Solutions, published between 2020 and 2026.

Dataset last synchronized: 2026-08-03 00:31:25 UTC

At a glance

Security Snapshot

26Total records
2Critical
7High
17Medium
0Low
0Informational
26Patched records
0Currently marked unpatched
2020-09-16First disclosure
2026-07-15Latest disclosure
21 of 26CVE coverage

Use this history

Check and watch MultiVendorX – WooCommerce Multivendor Marketplace AI Powered Solutions.

A history record does not establish whether the version installed on your website is affected. Enter the exact version in the checker, or add this software to a private Critical/High alert watchlist.

Check my installed versionWatch MultiVendorX – WooCommerce Multivendor Marketplace AI Powered Solutions

Year-by-Year Timeline

YearRecordsRelative volume
202011 records
202122 records
202244 records
202322 records
202499 records
202577 records
202611 records

Severity Breakdown

SeverityRecordsShare
Critical27.7%
High726.9%
Medium1765.4%

Vulnerability-Type Breakdown

Missing Authorization

12 records46.2%

First: 2021. Latest: 2025.

Cross-Site Scripting

7 records26.9%

First: 2021. Latest: 2025.

CSRF

3 records11.5%

First: 2020. Latest: 2024.

Other

1 record3.8%

First: 2022. Latest: 2022.

Path Traversal

1 record3.8%

First: 2025. Latest: 2025.

Information Disclosure

1 record3.8%

First: 2025. Latest: 2025.

SQL Injection

1 record3.8%

First: 2026. Latest: 2026.

Patch Status

Patched
26
Currently marked unpatched
0
Unknown status
0

Patch status reflects the latest successfully synchronized source dataset and must be checked against the installed version.

Latest Known Patched Versions

  • 5.0.10
  • 4.2.24
  • 4.2.23
  • 4.2.20
  • 4.2.15
  • 4.2.14
  • 4.2.5
  • 4.2.1
  • 4.2.0
  • 4.1.12
  • 4.1.4
  • 4.0.26
  • 4.0.24
  • 3.8.12
  • 3.8.4
  • 3.7.4
  • 3.5.8

Affected-Version History

Ranges are deduplicated by source range record and shown with the associated disclosure and known patched versions.

Affected rangeVulnerabilityPublishedPatched versionSeverity
[*, 3.5.8)MultiVendorX – MultiVendor Marketplace Solution For WooCommerce <= 3.5.7 - Cross-Site Request Forgery BypassSeptember 16, 20203.5.8Medium

Selected source records

Latest Records

MediumCVE-2026-12941

MultiVendorX <= 5.0.9 - Authenticated (Store Owner+) SQL Injection via 'order_by' Parameter

Published: July 15, 2026

Affected versions
*-5.0.9
Patched versions
5.0.10
Original Wordfence record
MediumCVE-2025-49916

MultiVendorX <= 4.2.23 - Missing Authorization

Published: June 12, 2025

Affected versions
*-4.2.23
Patched versions
4.2.24
Original Wordfence record
MediumCVE-2025-48261

MultiVendorX <= 4.2.22 - Unauthenticated Information Exposure

Published: June 4, 2025

Affected versions
*-4.2.22
Patched versions
4.2.23
Original Wordfence record
MediumCVE-2025-48263

MultiVendorX <= 4.2.22 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published: May 19, 2025

Affected versions
*-4.2.22
Patched versions
4.2.23
Original Wordfence record
MediumCVE-2025-4101

MultiVendorX – WooCommerce Multivendor Marketplace Solutions <= 4.2.22 - Incorrect Authorization to Authenticated (Contributor+) Arbitrary Post Deletion

Published: May 16, 2025

Affected versions
*-4.2.22
Patched versions
4.2.23
Original Wordfence record
MediumCVE-2025-2789

MultiVendorX – The Ultimate WooCommerce Multivendor Marketplace Solution <= 4.2.19 - Missing Authorization to Unauthenticated Table Rates Deletion

Published: April 4, 2025

Affected versions
*-4.2.19
Patched versions
4.2.20
Original Wordfence record
CriticalCVE-2025-0493

MultiVendorX – The Ultimate WooCommerce Multivendor Marketplace Solution <= 4.2.14 - Unauthenticated Limited Local File Inclusion

Published: January 30, 2025

Affected versions
*-4.2.14
Patched versions
4.2.15
Original Wordfence record
MediumCVE-2025-24706

WC Marketplace <= 4.2.13 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published: January 24, 2025

Affected versions
*-4.2.13
Patched versions
4.2.14
Original Wordfence record

Highest-Severity Records

CriticalCVE-2025-0493

MultiVendorX – The Ultimate WooCommerce Multivendor Marketplace Solution <= 4.2.14 - Unauthenticated Limited Local File Inclusion

Published: January 30, 2025

Affected versions
*-4.2.14
Patched versions
4.2.15
Original Wordfence record
CriticalCVE-2024-8289

MultiVendorX – The Ultimate WooCommerce Multivendor Marketplace Solution <= 4.2.0 - Missing Authorization to Limited Vendor Privilege Escalation/Account Takeover

Published: September 3, 2024

Affected versions
*-4.2.0
Patched versions
4.2.1
Original Wordfence record
HighCVE-2022-2657

Multivendor Marketplace Solution for WooCommerce – WC Marketplace <= 3.8.11.8 - Cross-Site Request Forgery

Published: August 4, 2022

Affected versions
*-3.8.11.8
Patched versions
3.8.12
Original Wordfence record
HighCVE-2024-24703

MultiVendorX Marketplace <= 4.0.25 - Missing Authorization

Published: January 31, 2024

Affected versions
*-4.0.25
Patched versions
4.0.26
Original Wordfence record
High

MultiVendorX <= 4.0.25 - Improper Authorization on REST Routes via 'save_settings_permission'

Published: September 12, 2023

Affected versions
[*, 4.0.26)
Patched versions
4.0.26
Original Wordfence record
High

Multivendor Marketplace Solution for WooCommerce – WC Marketplace <= 3.8.11.8 - Local File Inclusion

Published: August 15, 2022

Affected versions
*-3.8.11.8
Patched versions
3.8.12
Original Wordfence record
HighCVE-2023-51355

WC Marketplace <= 4.0.23 - Missing Authorization via mvx_save_dashpages

Published: December 26, 2023

Affected versions
*-4.0.23
Patched versions
4.0.24
Original Wordfence record
HighCVE-2024-8289

MultiVendorX – The Ultimate WooCommerce Multivendor Marketplace Solution <= 4.2.0 - Missing Authorization to Arbitrary Vendor Deletion

Published: September 3, 2024

Affected versions
*-4.2.0
Patched versions
4.2.1
Original Wordfence record

View all associated vulnerabilities

Need help reviewing an exposed WordPress website?

Running an affected version does not prove that a website was compromised. Suspicious redirects, unknown administrators, injected content, unexpected files or recurring malware may require a manual investigation.

WordPress Malware RemovalWordPress Security MaintenanceContact 3Zero Digital

Vulnerability data: Wordfence Intelligence. Analysis and practical guidance: 3Zero Digital.

Data Source, Attribution and Methodology

This page aggregates active Production Feed records. Counts are not software-quality rankings, and an affected version does not prove exploitation or infection. Read the full methodology.

Return to the Security History Directory