WP Security CheckVulnerability data as of October 22, 2026

Known vulnerabilities in WC Vendors – WooCommerce Multivendor, WooCommerce Marketplace, Product Vendors

The original WooCommerce multi-vendor plugin. Easily create a WooCommerce marketplace with multi-seller, product vendor stores & vendor commissions.

10Reported vulnerabilities
7.2Highest CVSS score
2.7.1Latest version
3,000+Active installs

What to do now

Update WC Vendors – WooCommerce Multivendor, WooCommerce Marketplace, Product Vendors to 2.7.2.2 or later. 10 of these have a fixed version available. Updating resolves them.

Plugin last updated: August 4, 2026 / Tested up to WordPress: 7.0.4 / View on wordpress.org

Reported vulnerabilities

Ordered by how urgently they need attention — whether a vulnerability is actually being exploited, and how likely exploitation is, rather than CVSS severity alone.

CVESeverityExploit probability
next 30 days		 Affected versionsFixed inPublished
CVE-2023-0072 Medium 5.4 0.7% Before 2.4.5 2.4.5 February 6, 2023
CVE-2023-48327 High 7.2 0.7% 2.4.7 and earlier 2.4.7.1 November 23, 2023
CVE-2026-54838 Medium 6.5 0.4% 2.6.8 and earlier 2.6.9 June 18, 2026
CVE-2026-66625 Medium 4.9 0.4% 2.7.2.1 and earlier 2.7.2.2 September 17, 2026
CVE-2026-15351 Medium 4.9 0.5% 0 to 2.7.0 (inclusive) 2.7.1 August 16, 2026
CVE-2025-49263 Medium 4.9 0.4% 2.5.6 and earlier 2.5.7 June 5, 2025
CVE-2026-81427 Medium 4.3 0.3% Before 2.7.2.1 2.7.2.1 September 2, 2026
CVE-2026-81428 Medium 4.3 0.3% Before 2.7.2.1 2.7.2.1 September 2, 2026
CVE-2026-81426 Medium 4.3 0.2% Before 2.7.2.1 2.7.2.1 September 2, 2026
CVE-2025-12130 Medium 4.3 0.1% 0 to 2.6.4 (inclusive) 2.6.4.1 December 5, 2025

Sources: vulnerability records from NVD, exploitation from CISA KEV, exploit probability from EPSS. Affected versions come from CPE ranges or from the reporting CNA.