Dokan vulnerabilities
10 vulnerabilities
Known vulnerabilities in Dokan products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 3 products.
Products
3- Dokan6 vulnerabilities
- Dokan Pro3 vulnerabilities
- Open Source File System1 vulnerabilities
CVE-2018-5410dokan-devdokany+1
EPSS score1.59%
Dokan, versions between 1.0.0.5000 and 1.2.0.1000, are vulnerable to a stack-based buffer overflow in the dokan1.sys driver. An attacker can create a device handle to the system driver and send arbitrary input that will trigger the vulnerability. This vulnerability was introduced in the 1.0.0.5000 version update.CVE-2025-39497dokandokan pro+1EPSS score0.15%
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dokan Dokan Pro allows Stored XSS.This issue affects Dokan Pro: from n/a through 3.14.5.CVE-2020-36748dokandokan+2EPSS score0.46%
The Dokan plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.0.8. This is due to missing or incorrect nonce validation on the handle_order_export() function. This makes it possible for unauthenticated attackers to trigger an order export via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.CVE-2022-3194dokandokan+2EPSS score0.49%
The Dokan WordPress plugin before 3.6.4 allows vendors to inject arbitrary javascript in product reviews, which may allow them to run stored XSS attacks against other users like site administrators.CVE-2022-3915dokandokan+2EPSS score1.13%
The Dokan WordPress plugin before 3.7.6 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated usersCVE-2024-3922dokandokan+2EPSS score52.91%
The Dokan Pro plugin for WordPress is vulnerable to SQL Injection via the 'code' parameter in all versions up to, and including, 3.10.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.CVE-2026-65494dokandokan pro+1EPSS score0.29%
Subscriber SQL Injection in Dokan Pro <= 5.0.2 versions.CVE-2026-65493dokandokan pro+1EPSS score0.40%
Subscriber PHP Object Injection in Dokan Pro <= 5.0.2 versions.CVE-2023-26525dokandokan+2EPSS score0.57%
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in weDevs Dokan – Best WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy.This issue affects Dokan – Best WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy: from n/a through 3.7.12.CVE-2023-34382dokandokan+2EPSS score0.68%
Deserialization of Untrusted Data vulnerability in weDevs Dokan – Best WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy.This issue affects Dokan – Best WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy: from n/a through 3.7.19.