DA
Product
Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy
8
CVEs
0
On KEV
8.8
Max CVSS
1
New 30D
Severity mix
Critical 0High 2Medium 6Low 0
Watch
Add Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-8761 | 8.8 | Aug 5 | Dokan <= 5.0.2 - Missing Authorization to Authenticated (Vendor+) Privilege Escalation Affected: <=5.0.2 |
| CVE-2025-14977 | 8.1 | Jan 20 | Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy <= 4.2.4 - Insecure Direct Object Reference to PayPal Account Takeover and Sensitive Information Disclosure Affected: through 4.2.4 |
| CVE-2026-11783 | 6.4 | Jun 27 | Dokan: AI Powered WooCommerce Multivendor Marketplace Solution <= 5.0.4 - Authenticated (Custom+) Stored Cross-Site Scripting via Product SKU Affected: through 5.0.4 |
| CVE-2026-3504 | 5.3 | May 2 | Dokan: AI Powered WooCommerce Multivendor Marketplace Solution <= 4.3.1 - Unauthenticated Information Disclosure in Store Reviews REST API Endpoint Affected: through 4.3.1 |
| CVE-2026-89280 | 4.3 | Oct 16 | Dokan: AI Powered WooCommerce Multivendor Marketplace Solution <= 5.2.1 - Insecure Direct Object Reference to Authenticated (Custom+) Limited Account Takeover via 'password' Parameter to /wp-json/dokan/v1/customers/{id} Affected: through 5.2.1 |
| CVE-2026-11987 | 4.3 | Jun 27 | Dokan: AI Powered WooCommerce Multivendor Marketplace Solution <= 5.0.4 - Authenticated (Subscriber+) Insecure Direct Object Reference to Information Disclosure via 'id' Parameter Affected: through 5.0.4 |
| CVE-2026-10023 | 4.3 | Jun 18 | Dokan: AI Powered WooCommerce Multivendor Marketplace Solution <= 5.0.3 - Insecure Direct Object Reference to Authenticated (Custom+) Arbitrary Order Modification via Multiple AJAX Handlers Affected: through 5.0.3 |
| CVE-2020-36748 | 4.3 | Jul 1 | Dokan <= 3.0.8 - Cross-Site Request Forgery Bypass Affected: before 3.0.9 |
Showing 8