Dokan
4 CVEs across 3 Dokan products. Browse Dokan vulnerabilities, severities, and proof-of-concept exploits.
Dokan products with known CVEs
Dokan CVEs — newest first| CVE | Severity | Score | Published | Summary |
|---|
CVE-2026-65494 | High | 7.1 | 2026-07-23 | Subscriber SQL Injection in Dokan Pro <= 5.0.2 versions. |
CVE-2026-65493 | High | 7.5 | 2026-07-23 | Subscriber PHP Object Injection in Dokan Pro <= 5.0.2 versions. |
CVE-2025-39497 | Medium | 6.5 | 2026-01-05 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dokan Dokan Pro allows Stored XSS.This issue affects Doka… |
CVE-2024-3922 | Critical | 10.0 | 2024-06-13 | The Dokan Pro plugin for WordPress is vulnerable to SQL Injection via the 'code' parameter in all versions up to, and including, 3.10.3 due to insufficient esc… |
CVE-2022-3194 | Medium | 5.4 | 2024-01-16 | The Dokan WordPress plugin before 3.6.4 allows vendors to inject arbitrary javascript in product reviews, which may allow them to run stored XSS attacks agains… |
CVE-2023-26525 | High | 7.1 | 2023-12-20 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in weDevs Dokan – Best WooCommerce Multivendor Marketplace S… |
CVE-2023-34382 | Medium | 4.4 | 2023-12-19 | Deserialization of Untrusted Data vulnerability in weDevs Dokan – Best WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy.This is… |
CVE-2020-36748 | Medium | 4.3 | 2023-07-01 | The Dokan plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.0.8. This is due to missing or incorrect nonce v… |
CVE-2022-3915 | Critical | 9.8 | 2022-12-12 | The Dokan WordPress plugin before 3.7.6 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploi… |
CVE-2018-5410 | High | 7.8 | 2019-01-07 | Dokan, versions between 1.0.0.5000 and 1.2.0.1000, are vulnerable to a stack-based buffer overflow in the dokan1.sys driver. An attacker can create a device ha… |