Skip to content
Wedevs Dokan vulnerabilities
-
wedevs wepos – point of sale (pos) for woocommerce & dokan
wePOS before 2.0.3 Missing Authorization via payment/process Endpoint
CVE-2026-121993
5.3 Medium
-
dokan, inc. dokan
WordPress Dokan plugin <= 5.3.2 - Broken Access Control vulnerability
CVE-2026-119485
5.3 Medium
-
dokan, inc. dokan
WordPress Dokan plugin <= 5.3.2 - Broken Access Control vulnerability
CVE-2026-119487
5.3 Medium
-
dokan, inc. dokan
WordPress Dokan plugin <= 5.3.1 - PHP Object Injection vulnerability
CVE-2026-115590
7.2 High
-
dokan pro, wedevs dokan pro +1 more
WordPress Dokan Pro plugin < 5.0.7 - Cross Site Scripting (XSS) vulnerability
CVE-2026-65492
7.1 High
-
dokan pro, wedevs dokan pro +1 more
Dokan Pro <= 5.0.4 - Authenticated (Vendor+) Privilege Escalation via update_capabilities REST Endpoint
CVE-2026-12224
8.8 High
-
dokan pro, wedevs dokan pro +1 more
Dokan Pro <= 5.0.4 - Unauthenticated SQL Injection via 'latitude' and 'longitude' Parameters
CVE-2026-12077
7.5 High
-
dokan pro, wedevs dokan pro +1 more
Dokan Pro <= 5.0.4 - Authenticated (Subscriber+) SQL Injection via 'orderby' Parameter
CVE-2026-12079
6.5 Medium
-
dokan pro, wedevs dokan pro +1 more
dokan pro <= 4.1.3 - Missing Authorization to Unauthenticated Sensitive Information Exposure
CVE-2025-12809
5.3 Medium
-
dokan pro, wedevs dokan pro +1 more
Dokan Pro <= 4.0.5 - Authenticated (Vendor+) Privilege Escalation
CVE-2025-5931
8.8 High
-
dokan, dokan pro, wedevs dokan pro +2 more
Dokan Pro <= 3.10.3 - Unauthenticated SQL Injection
CVE-2024-3922
Public exploit
EPSS 52.9%
10.0 Critical
-
dokan, wedevs dokan – best woocommerce multivendor marketplace solution – build your own amazon, ebay, etsy +1 more
WordPress Dokan Plugin <= 3.7.12 is vulnerable to SQL Injection
CVE-2023-26525
7.1 High
-
dokan, wedevs dokan – best woocommerce multivendor marketplace solution – build your own amazon, ebay, etsy +1 more
WordPress Dokan Plugin <= 3.7.19 is vulnerable to PHP Object Injection
CVE-2023-34382
4.4 Medium