Skip to content
PluginCanary

MultiVendorX

by MultiVendorX · 2,000+ active installs · Checked 3 Nov 2026
Healthy

Healthy: released 7 days ago, tested with WordPress 7.1, no open vulnerabilities.

85/ 100 Canary Score

Based on 4 of 5 areas

Sub-scores for MultiVendorX
Ownership100
Maintenance100
Security50
Support100
ReputationNo data

How the score works

Quick answers

Is MultiVendorX still maintained?
Yes. Last release 29 Oct 2026, 112 releases in the last 24 months. 29 Oct 2026 · wordpress.org
Who owns MultiVendorX, and has it changed hands?
No change recorded. Main committer wcmp since Dec 2020. 3 Nov 2026 · SVN log
Was MultiVendorX removed from wordpress.org?
No. Listed on wordpress.org as of 3 Nov 2026. 3 Nov 2026 · wordpress.org
Is MultiVendorX safe?
34 known vulnerabilities, all fixed (latest in 5.0.21). Not on the exploited list. 30 Oct 2026 · Wordfence Intelligence
Is the latest MultiVendorX update safe to install?
No ownership change before 5.0.21. No one-star spike after it. 29 Oct 2026 · Release history

Active signals

Facts we detected, with links to the source.

  • InfoSEC-318 vulnerabilities published in the last 24 months. Review this plugin.4 Nov 2026Evidence

History: 34 past vulnerabilities, all patched.

Ownership timeline

Who commits to the plugin's code on wordpress.org, over time.

Committers and their active periods
Dualcube24 Jul 2015 to 31 May 2020, 183 commits
greyparrots16 Jun 2020 to 13 Aug 2020, 4 commits
purnendu19 Aug 2020 to 30 Mar 2021, 13 commits
wcmp16 Dec 2020 to 29 Oct 2026, 186 commits
rajsekharchatterjee1130 May 2023 to 27 Jun 2023, 3 commits
abhirup2313 Jul 2023 to 14 Nov 2023, 10 commits

6 committers recorded. No ownership changes recorded since 2015.

Maintenance

Last release
7 days ago
Releases, 24 months
112
Tested up to
7.1 current
Requires PHP
8.0 supported 8.2+
Releases per quarter
Releases per quarter for MultiVendorX
Q1 20242
Q2 202453
Q3 20242
Q4 20240
Q1 20250
Q2 20250
Q3 20250
Q4 202533
Q1 20261
Q2 202666
Q3 202610
Q4 20262

Last release 29 Oct 2026. Tested with WordPress 7.1 (current).

Reputation

Last 90 days: no reviews. Lifetime: 4.8.

Last 90 days vs lifetime average rating for MultiVendorX
Last 90 daysNo reviews
Lifetime4.8
Rating distribution
5 star402
4 star4
3 star4
2 star6
1 star16

Security record

18 vulnerabilities in 24 months (34 on record), all patched (latest fixed in 5.0.21).

Show 34 patched vulnerabilities
PublishedIssueCVSSAffectedFixed inDays to patch
30 Oct 2026MultiVendorX - WooCommerce Multivendor Marketplace AI Powered Solutions <= 5.0.20 - Authenticated (Subscriber+) Stored Cross-Site Scripting6.4<= 5.0.205.0.21Before disclosure
10 Oct 2026MultiVendorX - WooCommerce Multivendor Marketplace AI Powered Solutions <= 5.0.19 - Missing Authorization4.3<= 5.0.19Not affectedn/a
1 Oct 2026MultiVendorX <= 5.0.18 - Authenticated (Store Manager+) SQL Injection via 'order_by' Parameter6.5<= 5.0.185.0.19Before disclosure
14 Sep 2026MultiVendorX <= 5.0.15 - Missing Authorization4.3<= 5.0.155.0.16Before disclosure
11 Sep 2026MultiVendorX - WooCommerce Multivendor Marketplace AI Powered Solutions 5.0.0 - 5.0.15 - Authenticated (Custom Role+) Privilege Escalation6.35.0.0 to 5.0.155.0.16Before disclosure
31 Aug 2026MultiVendorX - WooCommerce Multivendor Marketplace AI Powered Solutions 5.0.13 - 5.0.14 - Unauthenticated Information Exposure5.35.0.13 to 5.0.145.0.15Before disclosure
18 Aug 2026MultiVendorX - WooCommerce Multivendor Marketplace AI Powered Solutions <= 5.0.17 - Missing Authorization5.3<= 5.0.17Not affectedn/a
7 Aug 2026MultiVendorX - WooCommerce Multivendor Marketplace AI Powered Solutions <= 5.0.10 - Missing Authorization5.3<= 5.0.105.0.11Before disclosure
5 Aug 2026MultiVendorX - WooCommerce Multivendor Marketplace AI Powered Solutions < 5.0.11 - Missing Authorization4.3< 5.0.115.0.11Before disclosure
27 Jul 2026MultiVendorX <= 5.0.10 - Insecure Direct Object Reference to Authenticated (Store Owner+) Cross-Store Commission Data Disclosure4.3<= 5.0.105.0.11Before disclosure
15 Jul 2026MultiVendorX <= 5.0.9 - Authenticated (Store Owner+) SQL Injection via 'order_by' Parameter6.5<= 5.0.95.0.10Before disclosure
12 Jun 2025MultiVendorX <= 4.2.23 - Missing Authorization5.3<= 4.2.234.2.24310
4 Jun 2025MultiVendorX <= 4.2.22 - Unauthenticated Information Exposure5.3<= 4.2.224.2.23318
19 May 2025MultiVendorX <= 4.2.22 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4<= 4.2.224.2.23334
16 May 2025MultiVendorX - WooCommerce Multivendor Marketplace Solutions <= 4.2.22 - Incorrect Authorization to Authenticated (Contributor+) Arbitrary Post Deletion4.3<= 4.2.224.2.23337
4 Apr 2025MultiVendorX - The Ultimate WooCommerce Multivendor Marketplace Solution <= 4.2.19 - Missing Authorization to Unauthenticated Table Rates Deletion5.3<= 4.2.194.2.20378
30 Jan 2025MultiVendorX - The Ultimate WooCommerce Multivendor Marketplace Solution <= 4.2.14 - Unauthenticated Limited Local File Inclusion9.8<= 4.2.144.2.15443
24 Jan 2025WC Marketplace <= 4.2.13 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4<= 4.2.134.2.14449
23 Oct 2024MultiVendorX - The Ultimate WooCommerce Multivendor Marketplace Solution <= 4.2.4 - Missing Authorization to Forged Vendor Profile Deletion Email Sending4.3<= 4.2.44.2.5541
23 Oct 2024MultiVendorX - The Ultimate WooCommerce Multivendor Marketplace Solution <= 4.2.4 - Cross-Site Request Forgery to Vendor Updates6.3<= 4.2.44.2.5541
3 Sep 2024MultiVendorX - The Ultimate WooCommerce Multivendor Marketplace Solution <= 4.2.0 - Missing Authorization to Limited Vendor Privilege Escalation/Account Takeover9.8<= 4.2.04.2.1592
9 Aug 2024WC Marketplace <= 4.1.17 - Reflected Cross-Site Scripting6.1<= 4.1.174.2.011
5 Jun 2024MultiVendorX Marketplace - WooCommerce MultiVendor Marketplace Solution <= 4.1.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via hover_animation Parameter6.4<= 4.1.114.1.12517
5 Apr 2024WC Marketplace <= 4.1.3 - Missing Authorization4.3<= 4.1.34.1.4578
28 Mar 2024WC Marketplace <= 4.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4<= 4.1.34.1.4586

Changelog mentions of security fixes: 5.0.10 (security, vulnerability); 5.0.11 (security, vulnerability); 5.0.15 (security, vulnerability); 5.0.16 (security, vulnerability); 5.0.18 (security, vulnerability).

Sources: Wordfence Intelligence, CISA Known Exploited Vulnerabilities, readme changelogs.

Support

100% of 18 support threads resolved in the last 2 months.

Momentum

2,000+ active installs. History builds with each weekly snapshot.

Weekly downloads, last 27 weeks
Weekly downloads for MultiVendorX
4 May 2026268
11 May 20261,521
18 May 20261,602
25 May 2026574
1 Jun 20261,361
8 Jun 2026562
15 Jun 20261,341
22 Jun 2026402
29 Jun 20261,316
6 Jul 2026519
13 Jul 20261,507
20 Jul 20261,345
27 Jul 20261,470
3 Aug 20261,163
10 Aug 20262,468
17 Aug 2026574
24 Aug 20261,450
31 Aug 2026641
7 Sep 20262,299
14 Sep 2026884
21 Sep 2026778
28 Sep 20261,995
5 Oct 2026929
12 Oct 20261,896
19 Oct 2026715
26 Oct 20262,192
2 Nov 2026136

Weekly downloads over the last 4 weeks are 4% above the 27-week average.

Healthier alternatives

Same job, rated Healthy, higher Canary Score. Never sponsored.

WCFM MembershipScore 89 · 10,000+DokanScore 86 · 30,000+WCFMScore 86 · 20,000+

Facts

Full nameMultiVendorX - WooCommerce Multivendor Marketplace AI Powered Solutions
Version5.0.21
AuthorMultiVendorX
Added24 Jul 2015
Last updated29 Oct 2026
Active installs2,000+
Requires WordPress6.4.0
Tested up to7.1.4
Requires PHP8.0
CategoryE-commerce & Shopping
TagsMarketplace, multivendor, multi vendor, multivendor marketplace, woocommerce marketplace

Other plugins by this author: CatalogX Product Catalog, Product, Notifima, Checkout Terms Conditions Popup for, MultiVendorX Razorpay Split Payment

Questions

Is MultiVendorX still maintained?

Yes. Last release 29 Oct 2026, 112 releases in the last 24 months.

Who owns MultiVendorX, and has it changed hands?

No change recorded. Main committer wcmp since Dec 2020.

Was MultiVendorX removed from wordpress.org?

No. Listed on wordpress.org as of 3 Nov 2026.

Is MultiVendorX safe?

34 known vulnerabilities, all fixed (latest in 5.0.21). Not on the exploited list.

Is the latest MultiVendorX update safe to install?

No ownership change before 5.0.21. No one-star spike after it.

Data: wordpress.org Plugins API, plugins SVN and Trac, wordpress.org reviews and support forum, Wordfence Intelligence, CISA KEV, NVD.Plugin data refreshed 3 Nov 2026.Report a data issue