Ddokaninc

Products

Exploited and recent CVEs

• CVE-2026-89280 Medium 4.3 Dokan: AI Powered WooCommerce Multivendor Marketplace Solution <= 5.2.1 - Insecure Direct Object Reference to Authenticated (Custom+) Limited Account Takeover via 'password' Parameter to /wp-json/dokan/v1/customers/{id} 0.2%
• CVE-2026-8761 High 8.8 Dokan <= 5.0.2 - Missing Authorization to Authenticated (Vendor+) Privilege Escalation 0.7%
• CVE-2026-11783 Medium 6.4 Dokan: AI Powered WooCommerce Multivendor Marketplace Solution <= 5.0.4 - Authenticated (Custom+) Stored Cross-Site Scripting via Product SKU 0.4%
• CVE-2026-11987 Medium 4.3 Dokan: AI Powered WooCommerce Multivendor Marketplace Solution <= 5.0.4 - Authenticated (Subscriber+) Insecure Direct Object Reference to Information Disclosure via 'id' Parameter 0.5%
• CVE-2026-10023 Medium 4.3 Dokan: AI Powered WooCommerce Multivendor Marketplace Solution <= 5.0.3 - Insecure Direct Object Reference to Authenticated (Custom+) Arbitrary Order Modification via Multiple AJAX Handlers 0.2%
• CVE-2026-3504 Medium 5.3 Dokan: AI Powered WooCommerce Multivendor Marketplace Solution <= 4.3.1 - Unauthenticated Information Disclosure in Store Reviews REST API Endpoint 0.3%
• CVE-2025-14977 High 8.1 Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy <= 4.2.4 - Insecure Direct Object Reference to PayPal Account Takeover and Sensitive Information Disclosure 0.3%
• CVE-2020-36748 Medium 4.3 Dokan <= 3.0.8 - Cross-Site Request Forgery Bypass 0.5%