WCVendors
Products
| Product | CVEs | Exploited | Latest |
|---|---|---|---|
| WC Vendors – WooCommerce Multivendor, WooCommerce Marketplace, Product Vendors | 2 | – | Aug 16, 2026 |
| WC Vendors Marketplace | 2 | – | Sep 17, 2026 |
Exploited and recent CVEs
- CVE-2026-66625 WordPress WC Vendors Marketplace plugin <= 2.7.2.1 - SQL Injection vulnerability 0.4%
- CVE-2026-15351 WC Vendors <= 2.7.0 - Authenticated (Shop Manager+) SQL Injection via 'status' Parameter 0.5%
- CVE-2025-12130 WC Vendors – WooCommerce Multivendor, WooCommerce Marketplace, Product Vendors <= 2.6.4 - Cross-Site Request Forgery to Vendor Product Deletion 0.1%
- CVE-2025-49263 WordPress WC Vendors Marketplace plugin <= 2.5.6 - SQL Injection Vulnerability 0.4%