Unknown Multivendorx vulnerabilities

5 CVEs affecting Unknown Multivendorx, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-74926, published 2026-09-16.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2026-74925, published 2026-09-11. High severity, CVSS 7.2. EPSS: 0.5% chance of exploitation in the next 30 days. The MultiVendorX WordPress plugin before 5.0.16 does not restrict who can update its role and capability settings, allowing users holding its vendor role to grant that role administrator-level…
CVE-2026-16605, published 2026-08-05. High severity, CVSS 7.2. EPSS: 0.5% chance of exploitation in the next 30 days. The MultiVendorX WordPress plugin before 5.0.11 does not verify that the store targeted through its REST API belongs to the requesting vendor, allowing an authenticated vendor (Store Owner and…
CVE-2026-74926, published 2026-09-16. High severity, CVSS 7.1. EPSS: 0.3% chance of exploitation in the next 30 days. The MultiVendorX WordPress plugin before 5.0.16 does not verify that a user owns the store they are acting on in one of its REST API routes, allowing any authenticated user, such as a subscriber, to…
CVE-2026-74927, published 2026-09-02. Medium severity, CVSS 5.3. EPSS: 0.3% chance of exploitation in the next 30 days. The MultiVendorX WordPress plugin before 5.0.15 does not have proper authorisation controls on one of its REST API listing routes, allowing unauthenticated users to retrieve vendor contact and…
CVE-2026-16746, published 2026-08-05. Low severity, CVSS 2.7. EPSS: 0.3% chance of exploitation in the next 30 days. The MultiVendorX WordPress plugin before 5.0.11 does not verify that the requested store belongs to the current user in one of its REST API endpoints, allowing any vendor-level user to read other…