Multidots develops a focused portfolio of WordPress plugins and WooCommerce extensions for e-commerce functionality and social integration, widely distributed through the WordPress plugin ecosystem. Its vulnerability profile concentrates on web-application input and access-control weaknesses—cross-site request forgery, cross-site scripting, improper authentication, and missing authorization—that recur across its social sharing, search, pricing, and analytics plugins and reflect the trust and capability boundaries inherent to WordPress extensions with direct access to order and user data. Defenders should monitor this vendor's plugin updates and apply patches promptly given the plugins' prevalence in e-commerce deployments; current severity, exploitation, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Multidots over time
Signals from CVEs in this vendor scope (12 CVEs).
12 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2025-46244CRITICAL Missing Authorization vulnerability in Dotstore Advanced Linked Variations for Woocommerce linked-variation allows Exploiting Incorrectly Configured Access Control Security Levels. | Apr 22, 2025 | 9.8 | 26 | NO | NO |
CVE-2023-40559HIGH Cross-Site Request Forgery (CSRF) vulnerability in theDotstore Dynamic Pricing and Discount Rules for WooCommerce plugin <= 2.4.0 versions. | Oct 4, 2023 | 8.8 | 25 | NO | NO |
CVE-2023-40561HIGH Cross-Site Request Forgery (CSRF) vulnerability in theDotstore Enhanced Ecommerce Google Analytics for WooCommerce plugin <= 3.7.1 versions. | Oct 4, 2023 | 8.8 | 25 | NO | NO |
CVE-2018-11633MEDIUM An issue was discovered in the MULTIDOTS Woo Checkout for Digital Goods plugin 2.1 for WordPress. If an admin user can be tricked into visiting a crafted URL created by an attacker | May 31, 2018 | 6.5 | 21 | NO | NO |
CVE-2018-11632MEDIUM An issue was discovered in the MULTIDOTS Add Social Share Messenger Buttons Whatsapp and Viber plugin 1.0.8 for WordPress. If an admin user can be tricked into visiting a crafted U | May 31, 2018 | 6.5 | 21 | NO | NO |
CVE-2023-40212MEDIUM Cross-Site Request Forgery (CSRF) vulnerability in theDotstore Product Attachment for WooCommerce plugin <= 2.1.8 versions. | Oct 3, 2023 | 6.5 | 19 | NO | NO |
CVE-2023-39159MEDIUM Cross-Site Request Forgery (CSRF) vulnerability in theDotstore Fraud Prevention For Woocommerce plugin <= 2.1.5 versions. | Oct 3, 2023 | 6.5 | 19 | NO | NO |
CVE-2018-11486MEDIUM An issue was discovered in the MULTIDOTS Advance Search for WooCommerce plugin 1.0.9 and earlier for WordPress. This plugin is vulnerable to a stored Cross-site scripting (XSS) vul | Jun 1, 2018 | 6.1 | 19 | NO | NO |
CVE-2018-11485MEDIUM The MULTIDOTS WooCommerce Quick Reports plugin 1.0.6 and earlier for WordPress is vulnerable to Stored XSS. It allows an attacker to inject malicious JavaScript code on the WooComm | Jun 1, 2018 | 6.1 | 19 | NO | NO |
CVE-2018-11580MEDIUM An issue was discovered in mass-pages-posts-creator.php in the MULTIDOTS Mass Pages/Posts Creator plugin 1.2.2 for WordPress. Any logged in user can launch Mass Pages/Posts creatio | May 31, 2018 | 5.4 | 19 | NO | NO |
Signals from CVEs in this vendor scope (12 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Multidots.
Media articles that mention a CVE ID that affects a product developed by Multidots — matched by CVE ID, not by vendor name.