Cross-Site Scripting
3 records20%First: 2022. Latest: 2026.
Plugin security history
Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy Vulnerability History & Security Timeline
The Wordfence Intelligence dataset currently contains 15 vulnerability records associated with Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy, published between 2020 and 2026.
Dataset last synchronized: 2026-08-03 00:31:25 UTC
At a glance
Security Snapshot
15Total records
1Critical
6High
8Medium
0Low
0Informational
15Patched records
0Currently marked unpatched
2020-09-16First disclosure
2026-07-10Latest disclosure
15 of 15CVE coverage
Use this history
Check and watch Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy.
A history record does not establish whether the version installed on your website is affected. Enter the exact version in the checker, or add this software to a private Critical/High alert watchlist.
Year-by-Year Timeline
| Year | Records | Relative volume |
|---|---|---|
| 2020 | 1 | |
| 2022 | 3 | |
| 2023 | 2 | |
| 2025 | 1 | |
| 2026 | 8 |
Severity Breakdown
| Severity | Records | Share |
|---|---|---|
| Critical | 1 | 6.7% |
| High | 6 | 40% |
| Medium | 8 | 53.3% |
Vulnerability-Type Breakdown
Privilege Escalation
3 records20%First: 2025. Latest: 2026.
Missing Authorization
3 records20%First: 2026. Latest: 2026.
CSRF
2 records13.3%First: 2020. Latest: 2022.
SQL Injection
2 records13.3%First: 2022. Latest: 2023.
Other
1 record6.7%First: 2023. Latest: 2023.
Information Disclosure
1 record6.7%First: 2026. Latest: 2026.
Patch Status
- Patched
- 15
- Currently marked unpatched
- 0
- Unknown status
- 0
Patch status reflects the latest successfully synchronized source dataset and must be checked against the installed version.
Latest Known Patched Versions
5.0.75.0.55.0.45.0.34.3.24.2.54.1.43.7.203.7.133.7.63.6.63.6.43.0.9
Affected-Version History
Ranges are deduplicated by source range record and shown with the associated disclosure and known patched versions.
| Affected range | Vulnerability | Published | Patched version | Severity |
|---|---|---|---|---|
*-5.0.6 | Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy <= 5.0.6 - Unauthenticated Stored Cross-Site Scripting | July 10, 2026 | 5.0.7 | High |
*-5.0.4 | Dokan: AI Powered WooCommerce Multivendor Marketplace Solution <= 5.0.4 - Authenticated (Subscriber+) Insecure Direct Object Reference to Information Disclosure via 'id' Parameter | June 26, 2026 | 5.0.5 | Medium |
*-5.0.4 | Dokan: AI Powered WooCommerce Multivendor Marketplace Solution <= 5.0.4 - Authenticated (Custom+) Stored Cross-Site Scripting via Product SKU | June 26, 2026 | 5.0.5 | Medium |
*-5.0.3 | Dokan: AI Powered WooCommerce Multivendor Marketplace Solution <= 5.0.3 - Insecure Direct Object Reference to Authenticated (Custom+) Arbitrary Order Modification via Multiple AJAX Handlers | June 17, 2026 | 5.0.4 | Medium |
*-5.0.2 | Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy <= 5.0.2 - Authenticated (Customer+) Privilege Escalation | June 3, 2026 | 5.0.3 | High |
*-4.3.1 | Dokan: AI Powered WooCommerce Multivendor Marketplace Solution <= 4.3.1 - Unauthenticated Information Disclosure in Store Reviews REST API Endpoint | May 1, 2026 | 4.3.2 | Medium |
*-4.2.4 | Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy <= 4.2.4 - Missing Authorization | March 16, 2026 | 4.2.5 | Medium |
*-4.2.4 | Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy <= 4.2.4 - Insecure Direct Object Reference to PayPal Account Takeover and Sensitive Information Disclosure | January 19, 2026 | 4.2.5 | High |
*-4.1.3 | Dokan <= 4.1.3 - Authenticated (Shop Manager+) Privilege Escalation | September 20, 2025 | 4.1.4 | High |
[*, 3.7.20) | Dokan <=3.7.19 - Authenticated(Shop Manager+) PHP Object Injection via create_dummy_vendor | June 7, 2023 | 3.7.20 | Medium |
*-3.7.12 | Dokan <= 3.7.12 - Authenticated (Vendor+) SQL Injection | March 2, 2023 | 3.7.13 | High |
*-3.7.5 | Dokan <= 3.7.5 - Unauthenticated SQL Injection | November 21, 2022 | 3.7.6 | Critical |
*-3.6.5 | Dokan <= 3.6.5 - Cross-Site Request Forgery | September 28, 2022 | 3.6.6 | High |
*-3.6.3 | Dokan <= 3.6.3 - Authenticated (Vendor+) Stored Cross-Site Scripting | September 13, 2022 | 3.6.4 | Medium |
[*, 3.0.9) | Dokan <= 3.0.8 - Cross-Site Request Forgery Bypass | September 16, 2020 | 3.0.9 | Medium |
Selected source records
Latest Records
HighCVE-2026-57706
Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy <= 5.0.6 - Unauthenticated Stored Cross-Site Scripting
Published: July 10, 2026
- Affected versions
- *-5.0.6
- Patched versions
- 5.0.7
MediumCVE-2026-11987
Dokan: AI Powered WooCommerce Multivendor Marketplace Solution <= 5.0.4 - Authenticated (Subscriber+) Insecure Direct Object Reference to Information Disclosure via 'id' Parameter
Published: June 26, 2026
- Affected versions
- *-5.0.4
- Patched versions
- 5.0.5
MediumCVE-2026-11783
Dokan: AI Powered WooCommerce Multivendor Marketplace Solution <= 5.0.4 - Authenticated (Custom+) Stored Cross-Site Scripting via Product SKU
Published: June 26, 2026
- Affected versions
- *-5.0.4
- Patched versions
- 5.0.5
MediumCVE-2026-10023
Dokan: AI Powered WooCommerce Multivendor Marketplace Solution <= 5.0.3 - Insecure Direct Object Reference to Authenticated (Custom+) Arbitrary Order Modification via Multiple AJAX Handlers
Published: June 17, 2026
- Affected versions
- *-5.0.3
- Patched versions
- 5.0.4
HighCVE-2026-49780
Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy <= 5.0.2 - Authenticated (Customer+) Privilege Escalation
Published: June 3, 2026
- Affected versions
- *-5.0.2
- Patched versions
- 5.0.3
MediumCVE-2026-3504
Dokan: AI Powered WooCommerce Multivendor Marketplace Solution <= 4.3.1 - Unauthenticated Information Disclosure in Store Reviews REST API Endpoint
Published: May 1, 2026
- Affected versions
- *-4.3.1
- Patched versions
- 4.3.2
MediumCVE-2026-24359
Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy <= 4.2.4 - Missing Authorization
Published: March 16, 2026
- Affected versions
- *-4.2.4
- Patched versions
- 4.2.5
HighCVE-2025-14977
Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy <= 4.2.4 - Insecure Direct Object Reference to PayPal Account Takeover and Sensitive Information Disclosure
Published: January 19, 2026
- Affected versions
- *-4.2.4
- Patched versions
- 4.2.5
Highest-Severity Records
CriticalCVE-2022-3915
Dokan <= 3.7.5 - Unauthenticated SQL Injection
Published: November 21, 2022
- Affected versions
- *-3.7.5
- Patched versions
- 3.7.6
HighCVE-2022-3194
Dokan <= 3.6.5 - Cross-Site Request Forgery
Published: September 28, 2022
- Affected versions
- *-3.6.5
- Patched versions
- 3.6.6
HighCVE-2026-49780
Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy <= 5.0.2 - Authenticated (Customer+) Privilege Escalation
Published: June 3, 2026
- Affected versions
- *-5.0.2
- Patched versions
- 5.0.3
HighCVE-2025-14977
Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy <= 4.2.4 - Insecure Direct Object Reference to PayPal Account Takeover and Sensitive Information Disclosure
Published: January 19, 2026
- Affected versions
- *-4.2.4
- Patched versions
- 4.2.5
HighCVE-2025-53425
Dokan <= 4.1.3 - Authenticated (Shop Manager+) Privilege Escalation
Published: September 20, 2025
- Affected versions
- *-4.1.3
- Patched versions
- 4.1.4
HighCVE-2026-57706
Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy <= 5.0.6 - Unauthenticated Stored Cross-Site Scripting
Published: July 10, 2026
- Affected versions
- *-5.0.6
- Patched versions
- 5.0.7
HighCVE-2023-26525
Dokan <= 3.7.12 - Authenticated (Vendor+) SQL Injection
Published: March 2, 2023
- Affected versions
- *-3.7.12
- Patched versions
- 3.7.13
MediumCVE-2023-34382
Dokan <=3.7.19 - Authenticated(Shop Manager+) PHP Object Injection via create_dummy_vendor
Published: June 7, 2023
- Affected versions
- [*, 3.7.20)
- Patched versions
- 3.7.20
Need help reviewing an exposed WordPress website?
Running an affected version does not prove that a website was compromised. Suspicious redirects, unknown administrators, injected content, unexpected files or recurring malware may require a manual investigation.
Vulnerability data: Wordfence Intelligence. Analysis and practical guidance: 3Zero Digital.
Data Source, Attribution and Methodology
This page aggregates active Production Feed records. Counts are not software-quality rankings, and an affected version does not prove exploitation or infection. Read the full methodology.