Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Release: Dokan: AI Powered WooCommerce Multivendor Marketplace Solution 5.0.14 Clear all filters
TI-2026-13831 CVE-2026-16577 · GHSA-qc72-vcjc-wr3h

Dokan < 5.0.14 - Vendor+ Reverse Withdrawal Ledger Manipulation via Client-Supplied Amount

Priority LOW 13

The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.14 does not validate a client-supplied payment amount against the vendor's actual outstanding balance when recording a revers…

CVSS 3.1LOW 2.7 Network High privileges No interaction EPSS 0.00281 Published 2026-08-21 Fixed in 5.0.14 CWE-863
TI-2026-13830 CVE-2026-16576 · GHSA-vqf4-66cf-wcw6

Dokan < 5.0.14 - Shop Manager+ Arbitrary Plugin Installation/Activation via REST API

Priority LOW 34

The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.14 does not correctly check user capabilities on some of its admin REST API routes, checking only for a WooCommerce managemen…

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.00462 Published 2026-08-21 Fixed in 5.0.14 CWE-284
TI-2026-13829 CVE-2026-16575 · GHSA-hmc3-7cfv-4mfr

Dokan < 5.0.14 - Unauthenticated Commission Settings Disclosure via Store Categories REST Endpoint

Priority LOW 30

The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.14 does not restrict access to per-vendor commission configuration returned by one of its unauthenticated store REST endpoint…

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00345 Published 2026-08-21 Fixed in 5.0.14 CWE-200