CVE-2024-5259

The MultiVendorX Marketplace – WooCommerce MultiVendor Marketplace Solution plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘hover_animation’ parameter in all versions up to, and including, 4.1.11 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

• CWE-79
• CWE-79

• https://plugins.trac.wordpress.org/browser/dc-woocommerce-multi-vendor/trunk/packages/mvx-elementor/widgets/class-mvx-widget-storesocial.php#L150Product
• https://plugins.trac.wordpress.org/changeset/3097002/Patch
• https://wordpress.org/plugins/dc-woocommerce-multi-vendor/#developersProduct, Release Notes
• https://www.wordfence.com/threat-intel/vulnerabilities/id/59a349f2-048d-49a5-92ea-c19f1d1cd45e?source=cveThird Party Advisory
• https://plugins.trac.wordpress.org/browser/dc-woocommerce-multi-vendor/trunk/packages/mvx-elementor/widgets/class-mvx-widget-storesocial.php#L150Product
• https://plugins.trac.wordpress.org/changeset/3097002/Patch
• https://wordpress.org/plugins/dc-woocommerce-multi-vendor/#developersProduct, Release Notes
• https://www.wordfence.com/threat-intel/vulnerabilities/id/59a349f2-048d-49a5-92ea-c19f1d1cd45e?source=cveThird Party Advisory

Published

Jun 6, 2024

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-52584Autolab is a course management service that enables auto-gra…5.4
• CVE-2024-52585Autolab is a course management service that enables auto-gra…5.4
• CVE-2024-52586eLabFTW is an open source electronic lab notebook for resear…7.8
• CVE-2024-52587StepSecurity's Harden-Runner provides network egress filteri…8.8
• CVE-2024-52588Strapi is an open-source content management system. Prior to…7.5
• CVE-2024-52589Discourse is an open source platform for community discussio…2.7
• CVE-2024-52590Misskey is an open source, federated social media platform. …6.5
• CVE-2024-52591Misskey is an open source, federated social media platform. …9.3
• CVE-2024-52592Misskey is an open source, federated social media platform. …5.3
• CVE-2024-52593Misskey is an open source, federated social media platform.I…5.3
• CVE-2024-52594Gomatrixserverlib is a Go library for matrix federation. Gom…4.3
• CVE-2024-52595lxml_html_clean is a project for HTML cleaning functionaliti…6.1