MultiLoca - WooCommerce Multi Locations Inventory Management

MultiLoca - WooCommerce Multi Locations Inventory Management has 3 disclosed vulnerabilities in the WordSec catalog, reported between 2025 and 2026; all 3 are fixed as of September 2026. Their average CVSS score is 8.4, and the most serious one scores 9.8 out of 10. Severity breakdown: 1 critical and 1 high. 2025 was the busiest year with 2 disclosures.

The most common weakness is Incorrect Privilege Assignment, behind 1 of the records (33%). Other recurring categories include Missing Authorization, SQL Injection.

Every one of the 3 issues recorded for MultiLoca - WooCommerce Multi Locations Inventory Management has a vendor fix available, so running the current release closes all known holes.

2 independent researchers contributed these findings, most of them (2) reported by Thái An.

Strategic Overview

Avg CVSSHigh

8.4/ 10

Patch Coverage100%

Open

Fixed

Get automatic notifications for all MultiLoca - WooCommerce Multi Locations Inventory Management vulnerabilities before they are exploited.

Highest severity on recordCVSS 9.8CVE-2025-9054

MultiLoca - WooCommerce Multi Locations Inventory Management <= 4.2.8 - Missing Authorization to Unauthenticated Arbitrary Options Update via 'wcmlim_settings_ajax_handler'

Read the full analysis

Vulnerability Records

3 records


2026-04-08 00:00	MultiLoca <= 4.2.15 - Authenticated (Subscriber+) Privilege Escalation MultiLoca - WooCommerce Multi… <= 4.2.15	`CVE-2026-39546`	8.8 High	Denver Jackson	Yes
2025-09-23 00:00	MultiLoca - WooCommerce Multi Locations Inventory Management <= 4.2.8 - Missing Authorization to Unauthenticated Arbitrary Options Update via 'wcmlim_settings_ajax_handler' MultiLoca - WooCommerce Multi… <= 4.2.8	`CVE-2025-9054`	9.8 Critical	Thái An	Yes
2025-01-31 00:00	MultiLoca - WooCommerce Multi Locations Inventory Management <= 4.1.11 - Authenticated (Subscriber+) SQL Injection MultiLoca - WooCommerce Multi… <= 4.1.11	`CVE-2024-13341`	6.5 Medium	Thái An	Yes

Showing 1–3 of 3 reports