Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 15

Export CSV
CVE-2026-107773

Dokan < 5.3.3 - Unauthenticated Order PII Disclosure and Note Manipulation via Orders REST Endpoint

The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.3.3 does not correctly verify authorization when serving a single order and its order notes, allowing unauthenticated attackers to read customer and order information and to add or delete order notes for a subset of orders.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Dokan Wordpress-extensions
Products
Ai Powered Woocommerce Multivendor Marketplace Solution:dokan: Ai Powered Woocommerce Multivendor Marketplace Solution Dokan
CVE-2026-66699

WordPress Dokan plugin <= 5.0.10 - Broken Access Control vulnerability

Custom role Broken Access Control in Dokan <= 5.0.10 versions.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Dokan Wordpress
Products
Dokan Wordpress
CVE-2026-65493

WordPress Dokan Pro plugin <= 5.0.2 - PHP Object Injection vulnerability

Subscriber PHP Object Injection in Dokan Pro <= 5.0.2 versions.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Dokan Wordpress
Products
Dokan Wordpress
CVE-2026-65494

WordPress Dokan Pro plugin <= 5.0.2 - SQL Injection vulnerability

Subscriber SQL Injection in Dokan Pro <= 5.0.2 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Dokan Wordpress
Products
Dokan Wordpress
CVE-2026-57706

WordPress Dokan plugin <= 5.0.6 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dokan, Inc. Dokan dokan-lite allows Reflected XSS.This issue affects Dokan: from n/a through <= 5.0.6.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Dokan Wordpress
Products
Dokan Wordpress
CVE-2025-39497

WordPress Dokan Pro plugin <= 3.14.5 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dokan Dokan Pro allows Stored XSS.This issue affects Dokan Pro: from n/a through 3.14.5.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Dokan Wordpress
Products
Dokan Pro Plugin Wordpress
CVE-2023-34382

WordPress Dokan Plugin <= 3.7.19 is vulnerable to PHP Object Injection

Deserialization of Untrusted Data vulnerability in weDevs Dokan – Best WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy.This issue affects Dokan – Best WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy: from n/a through 3.7.19.

CVSS 3.1 · 4.4 Medium EPSS < 1% KEV · Not listed
Vendors
Dokan
Products
Dokan
CVE-2023-26525

WordPress Dokan Plugin <= 3.7.12 is vulnerable to SQL Injection

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in weDevs Dokan – Best WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy.This issue affects Dokan – Best WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy: from n/a through 3.7.12.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Dokan
Products
Dokan
CVE-2026-24359

WordPress Dokan plugin <= 4.2.4 - Broken Authentication vulnerability

Authentication Bypass Using an Alternate Path or Channel vulnerability in Dokan, Inc. Dokan dokan-lite allows Authentication Abuse.This issue affects Dokan: from n/a through <= 4.2.4.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Dokan Wordpress
Products
Dokan Wordpress
CVE-2025-53425

WordPress Dokan plugin <= 4.1.3 - Privilege Escalation vulnerability

Incorrect Privilege Assignment vulnerability in Dokan, Inc. Dokan dokan-lite allows Privilege Escalation.This issue affects Dokan: from n/a through <= 4.1.3.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Dokan Wordpress
Products
Dokan Wordpress
CVE-2025-14977

Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy <= 4.2.4 - Insecure Direct Object Reference to PayPal Account Takeover and Sensitive Information Disclosure

The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 4.2.4 via the `/wp-json/dokan/v1/settings` REST API endpoint due to missing validation on a user-controlled key. This makes it possible for authenticated attackers, with customer-level permissions and above, to read or modify other vendors' store settings including sensitive payment information (PayPal email, bank account details, routing numbers, IBAN, SWIFT codes), phone numbers, and addresses, and change PayPal email addresses to attacker-controlled addresses, enabling financial theft when the marketplace processes payouts.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Dokan Wordpress
Products
Dokan Wordpress
CVE-2024-3922

Dokan Pro <= 3.10.3 - Unauthenticated SQL Injection

The Dokan Pro plugin for WordPress is vulnerable to SQL Injection via the 'code' parameter in all versions up to, and including, 3.10.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

CVSS 3.1 · 10 Critical EPSS 52.9% KEV · Not listed
Vendors
Dokan Wedevs
Products
Dokan Dokan Pro
CVE-2020-36748

Dokan <= 3.0.8 - Cross-Site Request Forgery Bypass

The Dokan plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.0.8. This is due to missing or incorrect nonce validation on the handle_order_export() function. This makes it possible for unauthenticated attackers to trigger an order export via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Dokan
Products
Dokan
CVE-2022-3194

Dokan < 3.6.4 - Vendor Stored Cross-Site Scripting

The Dokan WordPress plugin before 3.6.4 allows vendors to inject arbitrary javascript in product reviews, which may allow them to run stored XSS attacks against other users like site administrators.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Dokan
Products
Dokan
CVE-2022-3915

Dokan < 3.7.6 - Unauthenticated SQLi

The Dokan WordPress plugin before 3.7.6 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users

CVSS 3.1 · 9.8 Critical EPSS 1.1% KEV · Not listed
Vendors
Dokan
Products
Dokan