Dokan Ai Powered Woocommerce Multivendor Marketplace Solution

WordPress plugin · dokan-ai-powered-woocommerce-multivendor-marketplace-solution · WordPress.org ↗

Critical

High

Known total

Unfixed

Running Dokan Ai Powered Woocommerce Multivendor Marketplace Solution on your site? WP Alerts checks your installed version against every entry below and emails you only when one affects you. Free, no tracking.

Scan a site Monitor my sites →

Severity	Vulnerability	Affected	Fixed in	CVE	Published
HIGH CVSS 7.2	Dokan < 5.0.14 - Shop Manager+ Arbitrary Plugin Installation/Activation via REST API CVE.org	>=0, <5.0.14	v5.0.14	CVE-2026-16576	Aug 21, 2026
MEDIUM CVSS 5.3	Dokan < 5.0.14 - Unauthenticated Commission Settings Disclosure via Store Categories REST Endpoint CVE.org	>=0, <5.0.14	v5.0.14	CVE-2026-16575	Aug 21, 2026
MEDIUM CVSS 5.4	Dokan < 5.0.11 - Vendor+ Cross-Vendor Downloadable Product Access Grant via Order Downloads REST Endpoint CVE.org	>=0, <5.0.11	v5.0.11	CVE-2026-16574	Aug 8, 2026
MEDIUM CVSS 4.3	Dokan < 5.0.9 - Vendor+ Arbitrary Order Status Modification via orders/bulk-actions REST Endpoint CVE.org	>=0, <5.0.9	v5.0.9	CVE-2026-16564	Aug 3, 2026
MEDIUM CVSS 4.3	Dokan < 5.0.9 - Vendor+ Cross-Vendor Product Attribute Modification via Product Attribute REST API CVE.org	>=0, <5.0.9	v5.0.9	CVE-2026-16565	Aug 3, 2026
LOW CVSS 2.7	Dokan < 5.2.0 - Vendor+ Cross-Vendor Commission Settings Disclosure via Commission REST Endpoint CVE.org	>=0, <5.2.0	v5.2.0	CVE-2026-107694	Oct 11, 2026
LOW CVSS 2.7	Dokan < 5.0.14 - Vendor+ Reverse Withdrawal Ledger Manipulation via Client-Supplied Amount CVE.org	>=0, <5.0.14	v5.0.14	CVE-2026-16577	Aug 21, 2026
UNKNOWN	Dokan < 5.3.3 - Unauthenticated Order PII Disclosure and Note Manipulation via Orders REST Endpoint CVE.org	>=0, <5.3.3	v5.3.3	CVE-2026-107773	Nov 5, 2026
UNKNOWN	Dokan < 5.3.3 - Unauthenticated Email Sender Spoofing via Store Contact Form CVE.org	>=0, <5.3.3	v5.3.3	CVE-2026-107774	Nov 5, 2026
UNKNOWN	Dokan < 5.3.3 - Admin+ Cross-Site Vendor Activation CVE.org	>=0, <5.3.3	v5.3.3	CVE-2026-107775	Nov 5, 2026

Data aggregated from WPVulnerability, NVD/NIST, ENISA EUVD, CVE.org and WordPress.org. Provided as-is; verify with the plugin author before acting. Disclaimer.