Wc Vendors Vulnerabilities

The WC Vendors – WooCommerce Multivendor, WooCommerce Marketplace, Product Vendors plugin for WordPress is vulnerable to generic SQL Injection via the 'status' parameter in all versions up to, and including, 2.7.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the exis...

CVSS:

4.9

Affected:

up to 2.7.0

Fixed in:

2.7.1

Disclosed:

Aug 15, 2026

CVE-2026-15351 on NVD →

The WC Vendors – WooCommerce Multivendor, WooCommerce Marketplace, Product Vendors plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 2.6.8 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible...

CVSS:

6.5

Affected:

up to 2.6.8

Fixed in:

2.6.9

Disclosed:

Jun 18, 2026

CVE-2026-54838 on NVD →

The WC Vendors – WooCommerce Multivendor, WooCommerce Marketplace, Product Vendors plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.6.4. This is due to missing or incorrect nonce validation on the /vendor_dashboard/product/delete/ endpoint. This makes it possible...

CVSS:

4.3

Affected:

up to 2.6.4

Fixed in:

2.6.4.1

Disclosed:

Dec 4, 2025

CVE-2025-12130 on NVD →

The WC Vendors Marketplace plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 2.5.6 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level a...

CVSS:

4.9

Affected:

up to 2.5.6

Fixed in:

2.5.7

Disclosed:

Jun 5, 2025

CVE-2025-49263 on NVD →

The WC Vendors Marketplace plugin for WordPress is vulnerable to SQL Injection via search date parameters in versions up to, and including, 2.4.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers,...

CVSS:

7.2

Affected:

up to 2.4.7

Fixed in:

2.4.7.1

Disclosed:

Nov 23, 2023

CVE-2023-48327 on NVD →

The WC Vendors Marketplace plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in versions up to, and including, 2.4.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor lev...

CVSS:

6.4

Affected:

up to 2.4.4

Fixed in:

2.4.5

Disclosed:

Jan 11, 2023

CVE-2023-0072 on NVD →