WholesaleX vulnerabilities
CVEs whose affected-version data names the WholesaleX package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
2 CVEsRSS
CVE-2026-111955NoneWholesaleX < 3.0.9 - Unauthenticated Account Activation and Administrator Approval Bypass
The WholesaleX WordPress plugin before 3.0.9 does not check that a stored account confirmation code is set before comparing it with the one supplied in a request, allowing unauthenticated users to activate pending accounts and bypass th…
▾ Sunlitvia CVEORG
CVE-2026-111956NoneWholesaleX < 3.0.9 - Unauthenticated Imported User CSV Disclosure
The WholesaleX WordPress plugin before 3.0.9 does not protect or remove the user-import file it keeps in a publicly accessible location under a predictable name, allowing unauthenticated users to download the most recently imported user…
▾ Sunlitvia CVEORG