CVE-2025-48263 WordPress MultiVendorX plugin <= 4.2.22 - Cross Site Scripting (XSS) Vulnerability

What is CVE-2025-48263?

CVE-2025-48263 is a medium-severity cross-site scripting vulnerability in MultiVendorX, published on 19 May 2025. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.

Official description

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MultiVendorX MultiVendorX dc-woocommerce-multi-vendor allows Stored XSS.This issue affects MultiVendorX: from n/a through <= 4.2.22.

Weakness: CWE-79

Which versions are affected by CVE-2025-48263?

It affects 1 product.

Products include Multivendorx Multivendorx.

How do I fix CVE-2025-48263?

No fix has been published for CVE-2025-48263 yet. Limit exposure of the affected software until one is available.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2025-48263 being exploited?

There is no known exploitation of CVE-2025-48263 in the wild and no public exploit code.

Other vulnerabilities in MultiVendorX

• CVE-2025-0493 Path traversal in MultiVendorX – WooCommerce Multivendor Marketplace Solutions Critical 9.8
• CVE-2024-8289 Missing authorization in MultiVendorX – WooCommerce Multivendor Marketplace Solutions Critical 9.8
• CVE-2025-48261 WordPress MultiVendorX plugin <= 4.2.22 - Sensitive Data Exposure Vulnerability High 7.5
• CVE-2024-31304 WordPress MultiVendorX Marketplace <= 4.1.3 - Broken Access Control vulnerability High 7.1
• CVE-2024-5259 Cross-site scripting in MultiVendorX – WooCommerce Multivendor Marketplace Solutions Medium 6.4

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-h53g-gc6r-59pf.