Plugin icon

Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy

dokan-lite

Vulnerabilities:

16

Last Updated:

July 22, 2026

Active Installs:

40000

Published
Title
Fixed in
CVSS
Published
2026-07-24
Title
Dokan < 5.0.9 - Vendor+ Cross-Vendor Product Attribute Modification via Product Attribute REST API
Fixed in
Fixed in 5.0.9
CVSS
4.3 (medium)
Published
2026-07-24
Title
Dokan < 5.0.9 - Vendor+ Arbitrary Order Status Modification via orders/bulk-actions REST Endpoint
Fixed in
Fixed in 5.0.9
CVSS
4.3 (medium)
Published
2026-07-10
Title
Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy < 5.0.7 - Unauthenticated Stored Cross-Site Scripting
Fixed in
Fixed in 5.0.7
CVSS
7.2 (high)
Published
2026-06-26
Title
Dokan: AI Powered WooCommerce Multivendor Marketplace Solution < 5.0.5 - Authenticated (Subscriber+) Insecure Direct Object Reference to Information Disclosure via 'id' Parameter
Fixed in
Fixed in 5.0.5
CVSS
4.3 (medium)
Published
2026-06-26
Title
Dokan: AI Powered WooCommerce Multivendor Marketplace Solution < 5.0.5 - Authenticated (Custom+) Stored Cross-Site Scripting via Product SKU
Fixed in
Fixed in 5.0.5
CVSS
6.4 (medium)
Published
2026-06-17
Title
Dokan: AI Powered WooCommerce Multivendor Marketplace Solution < 5.0.4 - Insecure Direct Object Reference to Authenticated (Custom+) Arbitrary Order Modification via Multiple AJAX Handlers
Fixed in
Fixed in 5.0.4
CVSS
4.3 (medium)
Published
2026-06-03
Title
Dokan < 5.0.3 - Customer+ Privilege Escalation
Fixed in
Fixed in 5.0.3
CVSS
8.8 (high)
Published
2026-05-01
Title
Dokan: AI Powered WooCommerce Multivendor Marketplace Solution < 4.3.2 - Unauthenticated Information Disclosure in Store Reviews REST API Endpoint
Fixed in
Fixed in 4.3.2
CVSS
5.3 (medium)
Published
2026-03-16
Title
Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy < 4.2.5 - Missing Authorization
Fixed in
Fixed in 4.2.5
CVSS
4.3 (medium)
Published
2026-01-19
Title
Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy < 4.2.5 - Insecure Direct Object Reference to PayPal Account Takeover and Sensitive Information Disclosure
Fixed in
Fixed in 4.2.5
CVSS
8.1 (high)
Published
2025-09-20
Title
Dokan < 4.1.4 - Shop Manager+ Privilege Escalation
Fixed in
Fixed in 4.1.4
CVSS
7.2 (high)
Published
2022-11-21
Title
Dokan < 3.7.6 - Unauthenticated SQLi
Fixed in
Fixed in 3.7.6
CVSS
8.6 (high)
Published
2022-06-02
Title
Dokan < 3.6.4 - Vendor Stored Cross-Site Scripting
Fixed in
Fixed in 3.6.4
CVSS
5.4 (medium)
Published
2021-03-01
Title
Multiple Plugins - CSRF Nonce Bypasses
Fixed in
Fixed in 3.2.1
CVSS
5.4 (medium)
Published
2020-09-16
Title
Multiple Plugins/Themes - Cross-Site Request Forgery (CSRF)
Fixed in
Fixed in 3.0.9
CVSS
5.4 (medium)
Published
2020-09-16
Title
Dokan < 3.0.9 - Cross-Site Request Forgery
Fixed in
Fixed in 3.0.9
CVSS
4.3 (medium)