Read the docs

Dokan, Inc.

Records15All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical2CVSS 9.0–10.0
CVSS high9CVSS 7.0–8.9

Exploited now

Dokan, Inc. records in CISA KEV

No Dokan, Inc. vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Dokan 6 records HIGH

Records

6 records in Dokan · all components

TI-2022-03590 CVE-2022-3915 · GHSA-2776-fr3j-r98m

Dokan < 3.7.6 - Unauthenticated SQLi

Priority HIGH 82

The Dokan WordPress plugin before 3.7.6 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01134 Published 2022-12-12 Fixed in 3.7.6 CWE-89
TI-2024-03660 CVE-2024-3922 · GHSA-xprj-wrvh-8ppj

Dokan Pro <= 3.10.3 - Unauthenticated SQL Injection

Priority HIGH 81

The Dokan Pro plugin for WordPress is vulnerable to SQL Injection via the 'code' parameter in all versions up to, and including, 3.10.3 due to insufficient escaping on the user supplied parameter and lack of sufficient p…

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.52915 Published 2024-06-13 No fix listed CWE-89
TI-2022-02949 CVE-2022-3194 · GHSA-5g8x-4pjj-p6fm

Dokan < 3.6.4 - Vendor Stored Cross-Site Scripting

Priority MEDIUM 58

The Dokan WordPress plugin before 3.6.4 allows vendors to inject arbitrary javascript in product reviews, which may allow them to run stored XSS attacks against other users like site administrators.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00491 Published 2024-01-16 Fixed in 3.6.4 CWE-79
TI-2023-17212 CVE-2023-34382 · GHSA-q9cq-mv8c-985j

WordPress Dokan Plugin <= 3.7.19 is vulnerable to PHP Object Injection

Priority LOW 39

Deserialization of Untrusted Data vulnerability in weDevs Dokan – Best WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy.This issue affects Dokan – Best WooCommerce Multivendor Marketplace…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00683 Published 2023-12-19 No fix listed CWE-502
TI-2023-11662 CVE-2023-26525 · GHSA-p58h-72hv-ppfx

WordPress Dokan Plugin <= 3.7.12 is vulnerable to SQL Injection

Priority LOW 36

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in weDevs Dokan – Best WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy.This issue affect…

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.0057 Published 2023-12-20 No fix listed CWE-89
TI-2020-18917 CVE-2020-36748 · GHSA-wxjf-25cc-8vg7

Dokan <= 3.0.8 - Cross-Site Request Forgery Bypass

Priority LOW 20

The Dokan plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.0.8.

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.00464 Published 2023-07-01 Fixed in 3.0.9 CWE-352
Open these records in search →