SZB-e0e55a5e68
EUVD lists subscriber XSS in MultiVendorX 5.0.20 and earlier
- Status
- Unverified: only social posts report this so far
- Kind
- Vulnerability
- Vendor
- MultiVendorX
- Product
- MultiVendorX
- First seen
Summary
The EU Vulnerability Database entry EUVD-2026-114300, as relayed in a Mastodon post, describes a subscriber-level cross-site scripting flaw in MultiVendorX versions up to 5.0.20. The entry gives a CVSS v3.1 score of 6.5 and was last updated 2026-10-30.
If you use MultiVendorX
Update MultiVendorX to a version later than 5.0.20 if one is available
Restrict or review subscriber account registrations
Check vendor store pages for injected scripts
What the sources say 1
· Mastodon: “Subscriber Cross Site Scripting (XSS) in MultiVendorX <= 5.0.20 versions.” Source