Advisories · Technology

Dokan: AI Powered WooCommerce Multivendor Marketplace Solution.

Every CVE that names Dokan: AI Powered WooCommerce Multivendor Marketplace Solution among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-107775 CVE record

CVSS 2.7 Low

Dokan < 5.3.3 - Admin+ Cross-Site Vendor Activation
- Dokan: AI Powered WooCommerce Multivendor Marketplace Solution
- Broken access control
Not analysed yet 5 Nov 2026
CVE-2026-107774 CVE record

CVSS 5.3 Medium

Dokan < 5.3.3 - Unauthenticated Email Sender Spoofing via Store Contact Form
- Dokan: AI Powered WooCommerce Multivendor Marketplace Solution
- Authentication bypass
Not analysed yet 5 Nov 2026
CVE-2026-107773 CVE record

CVSS 6.5 Medium

Dokan < 5.3.3 - Unauthenticated Order PII Disclosure and Note Manipulation via Orders REST Endpoint
- Dokan: AI Powered WooCommerce Multivendor Marketplace Solution
- Broken access control
Not analysed yet 5 Nov 2026
CVE-2026-107694 CVE record

CVSS 2.7 Low

Dokan < 5.2.0 - Vendor+ Cross-Vendor Commission Settings Disclosure via Commission REST Endpoint
- Dokan: AI Powered WooCommerce Multivendor Marketplace Solution
- Information disclosure
Not analysed yet 11 Oct 2026
CVE-2026-16577 CVE record

CVSS 2.7 Low

Dokan < 5.0.14 - Vendor+ Reverse Withdrawal Ledger Manipulation via Client-Supplied Amount
- Dokan: AI Powered WooCommerce Multivendor Marketplace Solution
- Broken access control
Not analysed yet 21 Aug 2026
CVE-2026-16576 CVE record

CVSS 7.2 High

Dokan < 5.0.14 - Shop Manager+ Arbitrary Plugin Installation/Activation via REST API
- Dokan: AI Powered WooCommerce Multivendor Marketplace Solution
- Broken access control
Not analysed yet 21 Aug 2026
CVE-2026-16575 CVE record

CVSS 5.3 Medium

Dokan < 5.0.14 - Unauthenticated Commission Settings Disclosure via Store Categories REST Endpoint
- Dokan: AI Powered WooCommerce Multivendor Marketplace Solution
- Information disclosure
Not analysed yet 21 Aug 2026
CVE-2026-16574 CVE record

CVSS 5.4 Medium

Dokan < 5.0.11 - Vendor+ Cross-Vendor Downloadable Product Access Grant via Order Downloads REST Endpoint
- Dokan: AI Powered WooCommerce Multivendor Marketplace Solution
- Broken access control
Not analysed yet 8 Aug 2026
CVE-2026-16565 CVE record

CVSS 4.3 Medium

Dokan < 5.0.9 - Vendor+ Cross-Vendor Product Attribute Modification via Product Attribute REST API
- Dokan: AI Powered WooCommerce Multivendor Marketplace Solution
- Broken access control
Not analysed yet 3 Aug 2026
CVE-2026-16564 CVE record

CVSS 4.3 Medium

Dokan < 5.0.9 - Vendor+ Arbitrary Order Status Modification via orders/bulk-actions REST Endpoint
- Dokan: AI Powered WooCommerce Multivendor Marketplace Solution
- Broken access control
Not analysed yet 3 Aug 2026