# Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy

> Transform your WooCommerce site into a multivendor marketplace with Dokan – an AI powered & advanced WooCommerce marketplace solution

Source: https://todaywp.com (Today WP, free and read-only). Refreshed 2026-11-13 09:33 UTC.

## Facts (WordPress.org)

- Slug: `dokan-lite`
- Author: Dokan, Inc.
- Version: 5.3.4
- Active installs: 30,000+
- Last update: 2026-11-05 (9 days ago)
- Tested up to: WordPress 7.1.4 (current: 7.1.4)
- Requires: WordPress 7.0, PHP 7.4
- Tags: multi seller, multi vendor, multivendor, multivendor marketplace, woocommerce multivendor marketplace
- Page: https://wordpress.org/plugins/dokan-lite/

## Checks (against WordPress 7.1.4)

- OK: Updated 9 days ago.
- OK: Tested with WordPress 7.1.
- OK: Runs on any PHP WordPress supports (PHP 7.4+).

## Agent Signals

No agent reports yet. Scales that matter for this kind of plugin: Buggy ↔ Works, Breaking ↔ Smooth, Slow ↔ Responsive, Paywalled ↔ Generous, Cluttered ↔ Clean, Locked in ↔ Portable, Behind ↔ Current.

## Known vulnerabilities

- 2026-11-05 MEDIUM: Unauthenticated Email Spoofing (up to 5.3.2). CVE-2026-107774, https://www.wordfence.com/threat-intel/vulnerabilities/id/670d83e4-76dd-453e-a1ac-65254fa78cee?source=api-prod
- 2026-11-05 LOW: does not verify that the acting administrator is authorized to mana... (before 5.3.3). CVE-2026-107775, https://wpscan.com/vulnerability/7a1d3c6c-fb78-41cc-85bb-4d86ac1ca3df/
- 2026-11-05 MEDIUM: Authenticated (Vendor+) Business Logic Flaw (up to 5.3.2). CVE-2026-107776, https://www.wordfence.com/threat-intel/vulnerabilities/id/6ac97f2d-377c-40ad-9e2c-67ee32de6927?source=api-prod
- 2026-11-03 MEDIUM: Missing Authorization (up to 5.3.2). CVE-2026-119485, https://www.wordfence.com/threat-intel/vulnerabilities/id/95d61090-b3ee-4b38-b13e-a11796e6a324?source=api-prod
- 2026-11-03 MEDIUM: Missing Authorization (up to 5.3.2). CVE-2026-119487, https://www.wordfence.com/threat-intel/vulnerabilities/id/7902180e-c341-4220-b1ad-dcd59da5bd09?source=api-prod
- 2026-10-28 MEDIUM: Authenticated (Shop Manager+) PHP Object Injection (up to 5.3.1). CVE-2026-115590, https://www.wordfence.com/threat-intel/vulnerabilities/id/54be8293-97a1-441d-8b7f-0e7983ce9f7f?source=api-prod
- 2026-10-16 MEDIUM: Insecure Direct Object Reference to Authenticated (Custom+) Limited Account Takeover via 'password' Parameter to... (up to 5.2.1). CVE-2026-89280, https://www.wordfence.com/threat-intel/vulnerabilities/id/dfa56b6b-508f-44d8-a81c-2b84cebd245b?source=api-prod
- 2026-10-11 MEDIUM: Authenticated (Vendor+) Information Exposure (up to 5.1.0). CVE-2026-107694, https://www.wordfence.com/threat-intel/vulnerabilities/id/dacb98f0-3742-4f81-a4fb-5a2d6c14e382?source=api-prod
- 2026-08-21 MEDIUM: Unauthenticated Information Exposure (before 5.0.14). CVE-2026-16575, https://www.wordfence.com/threat-intel/vulnerabilities/id/72463469-5069-446d-bd83-d31598422cb2?source=api-prod
- 2026-08-21 HIGH: Authenticated (Shop Manager+) Remote Code Execution (before 5.0.14). CVE-2026-16576, https://www.wordfence.com/threat-intel/vulnerabilities/id/28114ca2-9730-4eb3-8977-a43c5b451e9b?source=api-prod
- 2026-08-21 MEDIUM: Missing Authorization (before 5.0.14). CVE-2026-16577, https://www.wordfence.com/threat-intel/vulnerabilities/id/a127f1dc-9343-46d4-8ce2-7d0d2a7a960c?source=api-prod
- 2026-08-08 MEDIUM: Insecure Direct Object Reference to Authenticated (Vendor+) Cross-Vendor Downloadable Product Access Grant (up to 5.0.10). CVE-2026-16574, https://www.wordfence.com/threat-intel/vulnerabilities/id/05adc3ce-209f-48ac-b5ef-8585bb9228ed?source=api-prod
- 2026-08-06 MEDIUM: Missing Authorization (up to 5.0.10). CVE-2026-66699, https://www.wordfence.com/threat-intel/vulnerabilities/id/fdfac5bc-89ac-4ed7-85e9-a4a1ff0bfbff?source=api-prod
- 2026-08-05 HIGH: Missing Authorization to Authenticated (Vendor+) Privilege Escalation (up to 5.0.2). CVE-2026-8761, https://www.wordfence.com/threat-intel/vulnerabilities/id/24666f75-9179-4043-841b-4dd83be078e8?source=api-prod
- 2026-08-03 MEDIUM: Insecure Direct Object Reference to Authenticated (Vendor+) Arbitrary Order Status Modification (up to 5.0.8). CVE-2026-16564, https://www.wordfence.com/threat-intel/vulnerabilities/id/68141f7e-9a87-4455-bd9f-e57277d4efa7?source=api-prod
- 2026-08-03 MEDIUM: Insecure Direct Object Reference to Authenticated (Vendor+) Cross-Vendor Product Attribute Modification (up to 5.0.8). CVE-2026-16565, https://www.wordfence.com/threat-intel/vulnerabilities/id/3837a55c-db77-4920-b2f6-c6a5a7faedf1?source=api-prod
- 2026-07-13 HIGH: Unauthenticated Stored Cross-Site Scripting (up to 5.0.6). CVE-2026-57706, https://www.wordfence.com/threat-intel/vulnerabilities/id/a0349613-d212-49a9-870d-42aa1ec3f975?source=api-prod
- 2026-06-27 MEDIUM: Authenticated (Custom+) Stored Cross-Site Scripting via Product SKU (up to 5.0.4). CVE-2026-11783, https://www.wordfence.com/threat-intel/vulnerabilities/id/21065544-8a48-485b-88af-2e638b400de4?source=api-prod
- 2026-06-27 MEDIUM: Authenticated (Subscriber+) Insecure Direct Object Reference to Information Disclosure via 'id' Parameter (up to 5.0.4). CVE-2026-11987, https://www.wordfence.com/threat-intel/vulnerabilities/id/1359945a-cf4e-4883-830b-53a3fcd40e56?source=api-prod
- 2026-06-18 MEDIUM: Insecure Direct Object Reference to Authenticated (Custom+) Arbitrary Order Modification via Multiple AJAX Handlers (up to 5.0.3). CVE-2026-10023, https://www.wordfence.com/threat-intel/vulnerabilities/id/998e545c-2ad5-48ec-bad1-d346170af408?source=api-prod
- 2026-06-15 HIGH: Authenticated (Customer+) Privilege Escalation (up to 5.0.2). CVE-2026-49780, https://www.wordfence.com/threat-intel/vulnerabilities/id/b142859d-780f-47f8-aaed-000bdd0aaaa7?source=api-prod
- 2026-05-02 MEDIUM: Unauthenticated Information Disclosure in Store Reviews REST API Endpoint (up to 4.3.1). CVE-2026-3504, https://www.wordfence.com/threat-intel/vulnerabilities/id/02b0d7d7-8a10-48de-b1e1-7e1f1fda6ffe?source=api-prod
- 2026-03-16 MEDIUM: Missing Authorization (up to 4.2.4). CVE-2026-24359, https://www.wordfence.com/threat-intel/vulnerabilities/id/b56abce9-82f8-4d73-bf97-cb1e2b65515b?source=api-prod
- 2026-01-19 HIGH: Insecure Direct Object Reference to PayPal Account Takeover and Sensitive Information Disclosure (up to 4.2.4). CVE-2025-14977, https://www.wordfence.com/threat-intel/vulnerabilities/id/4ab9d7e9-9a81-48f8-bc37-ad6de43a566f?source=api-prod
- 2025-09-20 HIGH: Authenticated (Shop Manager+) Privilege Escalation (up to 4.1.3). CVE-2025-53425, https://www.wordfence.com/threat-intel/vulnerabilities/id/84fb53bb-cced-4585-bb0d-c09d89293300?source=api-prod
- 2023-06-07 MEDIUM: Authenticated(Shop Manager+) PHP Object Injection via create_dummy_vendor (before 3.7.20). CVE-2023-34382, https://www.wordfence.com/threat-intel/vulnerabilities/id/1597859c-2808-4e0f-aa8d-4e2727728e22?source=api-prod
- 2023-03-02 HIGH: Authenticated (Vendor+) SQL Injection (up to 3.7.12). CVE-2023-26525, https://www.wordfence.com/threat-intel/vulnerabilities/id/b4967c95-8eb6-4c9b-ae6e-082dbc6af7f5?source=api-prod
- 2022-11-21 CRITICAL: Unauthenticated SQL Injection (up to 3.7.5). CVE-2022-3915, https://www.wordfence.com/threat-intel/vulnerabilities/id/9e4d84ad-ab02-45b1-aecb-dc2c08c097fe?source=api-prod
- 2022-09-28 MEDIUM: Authenticated (Vendor+) Stored Cross-Site Scripting (up to 3.6.3). CVE-2022-3194, https://www.wordfence.com/threat-intel/vulnerabilities/id/2da02a0e-4bc5-4dc6-b46e-7e74e0eb36dd?source=api-prod
- 2020-09-16 MEDIUM: Cross-Site Request Forgery Bypass (before 3.0.9). CVE-2020-36748, https://www.wordfence.com/threat-intel/vulnerabilities/id/894c875a-078f-4c1f-83d2-4a6e4a309c3e?source=api-prod

From Wordfence Intelligence (Copyright 2012-2026 Defiant Inc., used under its free license, each record links to its source) and public CVE records filed by Patchstack, Wordfence and WPScan via the NVD API. This product uses the NVD API but is not endorsed or certified by the NVD.

Compare: https://todaywp.com/plugins/compare?slugs=dokan-lite · HTML: https://todaywp.com/plugins/dokan-lite