Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

15 records

Vendor: Dokan, Inc. Clear all filters
TI-2025-26239 CVE-2025-39497 · GHSA-qv8g-4fgj-h6p6

WordPress Dokan Pro plugin <= 3.14.5 - Cross Site Scripting (XSS) vulnerability

Priority LOW 28

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dokan Dokan Pro allows Stored XSS.This issue affects Dokan Pro: from n/a through 3.14.5.

CVSS 3.1MEDIUM 6.5 Network Low privileges User interaction EPSS 0.00154 Published 2026-01-05 No fix listed CWE-79
TI-2024-03660 CVE-2024-3922 · GHSA-xprj-wrvh-8ppj

Dokan Pro <= 3.10.3 - Unauthenticated SQL Injection

Priority HIGH 81

The Dokan Pro plugin for WordPress is vulnerable to SQL Injection via the 'code' parameter in all versions up to, and including, 3.10.3 due to insufficient escaping on the user supplied parameter and lack of sufficient p…

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.52915 Published 2024-06-13 No fix listed CWE-89
TI-2022-02949 CVE-2022-3194 · GHSA-5g8x-4pjj-p6fm

Dokan < 3.6.4 - Vendor Stored Cross-Site Scripting

Priority MEDIUM 58

The Dokan WordPress plugin before 3.6.4 allows vendors to inject arbitrary javascript in product reviews, which may allow them to run stored XSS attacks against other users like site administrators.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00491 Published 2024-01-16 Fixed in 3.6.4 CWE-79
TI-2023-11662 CVE-2023-26525 · GHSA-p58h-72hv-ppfx

WordPress Dokan Plugin <= 3.7.12 is vulnerable to SQL Injection

Priority LOW 36

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in weDevs Dokan – Best WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy.This issue affect…

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.0057 Published 2023-12-20 No fix listed CWE-89
TI-2023-17212 CVE-2023-34382 · GHSA-q9cq-mv8c-985j

WordPress Dokan Plugin <= 3.7.19 is vulnerable to PHP Object Injection

Priority LOW 39

Deserialization of Untrusted Data vulnerability in weDevs Dokan – Best WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy.This issue affects Dokan – Best WooCommerce Multivendor Marketplace…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00683 Published 2023-12-19 No fix listed CWE-502
TI-2020-18917 CVE-2020-36748 · GHSA-wxjf-25cc-8vg7

Dokan <= 3.0.8 - Cross-Site Request Forgery Bypass

Priority LOW 20

The Dokan plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.0.8.

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.00464 Published 2023-07-01 Fixed in 3.0.9 CWE-352
TI-2022-03590 CVE-2022-3915 · GHSA-2776-fr3j-r98m

Dokan < 3.7.6 - Unauthenticated SQLi

Priority HIGH 82

The Dokan WordPress plugin before 3.7.6 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01134 Published 2022-12-12 Fixed in 3.7.6 CWE-89