https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2025-48261.htmlhttps://patchthecve.com/cve/CVE-2025-48261.htmlWed, 17 Jun 2026 09:29:21 +0000HIGH 7.5: Insertion of Sensitive Information Into Sent Data vulnerability in MultiVendorX MultiVendorX dc-woocommerce-multi-vendor allows Retrieve Embedded Sensitive Data.This issue affects MultiVendorX: from n/a through <= 4.2.22.https://patchthecve.com/cve/CVE-2025-48263.htmlhttps://patchthecve.com/cve/CVE-2025-48263.htmlWed, 17 Jun 2026 09:29:21 +0000MEDIUM 6.5: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MultiVendorX MultiVendorX dc-woocommerce-multi-vendor allows Stored XSS.This issue affects MultiVendorX: from n/a through <= 4.2.22.https://patchthecve.com/cve/CVE-2025-4101.htmlhttps://patchthecve.com/cve/CVE-2025-4101.htmlWed, 17 Jun 2026 09:32:30 +0000MEDIUM 4.3: The MultiVendorX – WooCommerce Multivendor Marketplace Solutions plugin for WordPress is vulnerable to unauthorized loss of data due to a misconfigured capability check on the 'delete_fpm_product' function in all versions up to, and including, 4.2.22. This makes it possible for authenticated attackehttps://patchthecve.com/cve/CVE-2025-0493.htmlhttps://patchthecve.com/cve/CVE-2025-0493.htmlWed, 17 Jun 2026 08:26:35 +0000CRITICAL 9.8: The MultiVendorX – The Ultimate WooCommerce Multivendor Marketplace Solution plugin for WordPress is vulnerable to Limited Local File Inclusion in all versions up to, and including, 4.2.14 via the tabname parameter. This makes it possible for unauthenticated attackers to include PHP files on the sehttps://patchthecve.com/cve/CVE-2024-9943.htmlhttps://patchthecve.com/cve/CVE-2024-9943.htmlWed, 17 Jun 2026 08:25:33 +0000MEDIUM 6.3: The MultiVendorX – The Ultimate WooCommerce Multivendor Marketplace Solution plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.2.4. This is due to missing or incorrect nonce validation on several functions in api/class-mvx-rest-controller.php. Thttps://patchthecve.com/cve/CVE-2024-9531.htmlhttps://patchthecve.com/cve/CVE-2024-9531.htmlWed, 17 Jun 2026 08:24:44 +0000MEDIUM 4.3: The MultiVendorX – The Ultimate WooCommerce Multivendor Marketplace Solution plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'mvx_sent_deactivation_request' function in all versions up to, and including, 4.2.4. This makes it possible fhttps://patchthecve.com/cve/CVE-2024-8289.htmlhttps://patchthecve.com/cve/CVE-2024-8289.htmlWed, 17 Jun 2026 08:22:17 +0000CRITICAL 9.8: The MultiVendorX – The Ultimate WooCommerce Multivendor Marketplace Solution plugin for WordPress is vulnerable to privilege escalation/de-escalation and account takeover due to an insufficient capability check on the update_item_permissions_check and create_item_permissions_check functions in all v