Dokan

10 CVEs across 3 Dokan products. Browse Dokan vulnerabilities, severities, and proof-of-concept exploits.

Dokan products with known CVEs

ProductCVEs
Dokan6
Dokan Pro3
Open Source File System1
Dokan CVEs — newest first
CVESeverityScorePublishedSummary
CVE-2026-65494High7.12026-07-23Subscriber SQL Injection in Dokan Pro <= 5.0.2 versions.
CVE-2026-65493High7.52026-07-23Subscriber PHP Object Injection in Dokan Pro <= 5.0.2 versions.
CVE-2025-39497Medium6.52026-01-05Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dokan Dokan Pro allows Stored XSS.This issue affects Doka…
CVE-2024-3922Critical10.02024-06-13The Dokan Pro plugin for WordPress is vulnerable to SQL Injection via the 'code' parameter in all versions up to, and including, 3.10.3 due to insufficient esc…
CVE-2022-3194Medium5.42024-01-16The Dokan WordPress plugin before 3.6.4 allows vendors to inject arbitrary javascript in product reviews, which may allow them to run stored XSS attacks agains…
CVE-2023-26525High7.12023-12-20Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in weDevs Dokan – Best WooCommerce Multivendor Marketplace S…
CVE-2023-34382Medium4.42023-12-19Deserialization of Untrusted Data vulnerability in weDevs Dokan – Best WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy.This is…
CVE-2020-36748Medium4.32023-07-01The Dokan plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.0.8. This is due to missing or incorrect nonce v…
CVE-2022-3915Critical9.82022-12-12The Dokan WordPress plugin before 3.7.6 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploi…
CVE-2018-5410High7.82019-01-07Dokan, versions between 1.0.0.5000 and 1.2.0.1000, are vulnerable to a stack-based buffer overflow in the dokan1.sys driver. An attacker can create a device ha…