Advisories · Technology
weDevs Dokan Pro.
Every CVE that names weDevs Dokan Pro among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 7.1 High
WordPress Dokan Pro plugin < 5.0.7 - Cross Site Scripting (XSS) vulnerability
- weDevs Dokan Pro
- Cross-site scripting (XSS)
- CVSS 8.8 High
Dokan Pro <= 5.0.4 - Authenticated (Vendor+) Privilege Escalation via update_capabilities REST Endpoint
- wedevs Dokan Pro
- Privilege escalation
- CVSS 7.5 High
Dokan Pro <= 5.0.4 - Unauthenticated SQL Injection via 'latitude' and 'longitude' Parameters
- wedevs Dokan Pro
- SQL injection
- CVSS 6.5 Medium
Dokan Pro <= 5.0.4 - Authenticated (Subscriber+) SQL Injection via 'orderby' Parameter
- wedevs Dokan Pro
- SQL injection
- CVSS 5.3 Medium
dokan pro <= 4.1.3 - Missing Authorization to Unauthenticated Sensitive Information Exposure
- wedevs Dokan Pro
- Broken access control
- CVSS 8.8 High
Dokan Pro <= 4.0.5 - Authenticated (Vendor+) Privilege Escalation
- wedevs Dokan Pro
- Privilege escalation
- CVSS 10.0 CriticalCritical · CVSS 9+, CVSS 7+ and EPSS
Dokan Pro <= 3.10.3 - Unauthenticated SQL Injection
- wedevs Dokan Pro
- SQL injection