WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
dokan-lite
Published
2026-01-19
Title
Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy < 4.2.5 - Insecure Direct Object Reference to PayPal Account Takeover and Sensitive Information Disclosure
Slug
dokan-lite
Published
2026-03-16
Title
Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy < 4.2.5 - Missing Authorization
Slug
dokan-lite
Published
2026-05-01
Title
Dokan: AI Powered WooCommerce Multivendor Marketplace Solution < 4.3.2 - Unauthenticated Information Disclosure in Store Reviews REST API Endpoint
Slug
dokan-lite
Published
2026-06-03
Title
Dokan < 5.0.3 - Customer+ Privilege Escalation
Slug
dokan-lite
Published
2026-06-17
Title
Dokan: AI Powered WooCommerce Multivendor Marketplace Solution < 5.0.4 - Insecure Direct Object Reference to Authenticated (Custom+) Arbitrary Order Modification via Multiple AJAX Handlers
Slug
dokan-lite
Published
2026-07-10
Title
Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy < 5.0.7 - Unauthenticated Stored Cross-Site Scripting
Slug
dokan-lite
Published
2026-06-26
Title
Dokan: AI Powered WooCommerce Multivendor Marketplace Solution < 5.0.5 - Authenticated (Subscriber+) Insecure Direct Object Reference to Information Disclosure via 'id' Parameter
Slug
dokan-lite
Published
2026-06-26
Title
Dokan: AI Powered WooCommerce Multivendor Marketplace Solution < 5.0.5 - Authenticated (Custom+) Stored Cross-Site Scripting via Product SKU
Slug
dokan-lite
Published
2026-07-29
Title
Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy < 5.0.11 - Missing Authorization
Slug
dokan-lite
Published
2026-07-24
Title
Dokan < 5.0.9 - Vendor+ Arbitrary Order Status Modification via orders/bulk-actions REST Endpoint
Slug
dokan-lite
Published
2026-07-24
Title
Dokan < 5.0.9 - Vendor+ Cross-Vendor Product Attribute Modification via Product Attribute REST API
Slug
dokan-lite
Published
2026-08-03
Title
Dokan < 5.0.11 - Vendor+ Cross-Vendor Downloadable Product Access Grant via Order Downloads REST Endpoint
Slug
dokan-lite
Published
2026-08-04
Title
Dokan < 5.0.3 - Missing Authorization to Authenticated (Vendor+) Privilege Escalation
Slug
dokan-lite
Published
2026-08-19
Title
Dokan < 5.0.14 - Shop Manager+ Arbitrary Plugin Installation/Activation via REST API
Slug
dokan-lite
Published
2026-08-19
Title
Dokan < 5.0.14 - Unauthenticated Commission Settings Disclosure via Store Categories REST Endpoint
Slug
dokan-lite
Published
2026-08-19
Title
Dokan < 5.0.14 - Vendor+ Reverse Withdrawal Ledger Manipulation via Client-Supplied Amount
Slug
dokan-lite
Published
2026-10-09
Title
Dokan < 5.2.0 - Vendor+ Cross-Vendor Commission Settings Disclosure via Commission REST Endpoint
Slug
dokan-lite
Published
2026-10-15
Title
Dokan: AI Powered WooCommerce Multivendor Marketplace Solution < 5.3.0 - Insecure Direct Object Reference to Authenticated (Custom+) Limited Account Takeover via 'password' Parameter to /wp-json/dokan/v1/customers/{id}
Slug
dokan-lite
Published
2026-10-26
Title
Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy < 5.3.2 - Authenticated (Shop Manager+) PHP Object Injection
Slug
dokan-pro
Published
2024-06-11
Title
Dokan Pro < 3.11.0 - Unauthenticated SQL Injection
Slug
dokan-pro
Published
2025-05-16
Title
Dokan Pro <= 3.14.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
dokan-pro
Published
2025-08-25
Title
Dokan Pro < 4.0.6 - Authenticated (Vendor+) Privilege Escalation
Slug
dokan-pro
Published
2025-12-15
Title
dokan pro < 4.2.0 - Missing Authorization to Unauthenticated Sensitive Information Exposure
Slug
dokan-pro
Published
2026-06-24
Title
Dokan Pro < 5.0.5 - Authenticated (Subscriber+) SQL Injection via 'orderby' Parameter
Slug
dokan-pro
Published
2026-06-24
Title
Dokan Pro < 5.0.5 - Unauthenticated SQL Injection via 'latitude' and 'longitude' Parameters