322 matches found
WCFM WooCommerce Multivendor Marketplace < 3.4.12 - SQL Injection
The wcfmajaxcontroller AJAX action of the WCFM Marketplace WordPress plugin before 3.4.12, available to unauthenticated and authenticated user, does not properly sanitise multiple parameters before using them in SQL statements, leading to SQL injections. id: CVE-2021-24849 info: name: WCFM...
CVE-2026-111847
Missing Authorization vulnerability in Kings Plugins MarketKing marketking-multivendor-marketplace-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MarketKing: from n/a through 2.1.72...
EUVD-2026-108030
Missing Authorization vulnerability in Kings Plugins MarketKing marketking-multivendor-marketplace-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MarketKing: from n/a through 2.1.72...
PT-2026-121280
Missing Authorization vulnerability in Kings Plugins MarketKing marketking-multivendor-marketplace-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MarketKing: from n/a through 2.1.72...
CVE-2026-89280
The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.2.1 via the 'password' parameter due to missing validation on a user controlled key...
CVE-2026-89280
The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution plugin for WordPress (versions up to and including 5.2.1 ) is vulnerable to an Insecure Direct Object Reference (IDOR) . The root cause is a lack of validation on a user-controlled key within the 'password' parameter of the /wp-js...
CVE-2026-89280 Dokan: AI Powered WooCommerce Multivendor Marketplace Solution <= 5.2.1 - Insecure Direct Object Reference to Authenticated (Custom+) Limited Account Takeover via 'password' Parameter to /wp-json/dokan/v1/customers/{id}
The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.2.1 via the 'password' parameter due to missing validation on a user controlled key...
CVE-2026-89280 Dokan: AI Powered WooCommerce Multivendor Marketplace Solution <= 5.2.1 - Insecure Direct Object Reference to Authenticated (Custom+) Limited Account Takeover via 'password' Parameter to /wp-json/dokan/v1/customers/{id}
The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.2.1 via the 'password' parameter due to missing validation on a user controlled key...
CVE-2026-89280: Authorization Bypass Through User-Controlled Key
The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.2.1 via the 'password' parameter due to missing validation on a user controlled key...
PT-2026-115416
The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.2.1 via the 'password' parameter due to missing validation on a user controlled key...
Dokan Multivendor Marketplace Authorization Issues Vulnerability
The Dokan Multivendor Marketplace versions 5.2.1 and earlier have an authorization issue vulnerability. This vulnerability stems from the lack of validation for user control keys via the 'password' parameter, making it vulnerable to insecure direct object reference attacks. This could allow...
CVE-2026-107694
The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.2.0 does not verify that the vendor a commission calculation is requested for is the requesting vendor, allowing vendors to disclose the commission rate and fixed fee the marketplace administrator...
EUVD-2026-96745
The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.2.0 does not verify that the vendor a commission calculation is requested for is the requesting vendor, allowing vendors to disclose the commission rate and fixed fee the marketplace administrator...
PT-2026-110018
The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.2.0 does not verify that the vendor a commission calculation is requested for is the requesting vendor, allowing vendors to disclose the commission rate and fixed fee the marketplace administrator...
CVE-2026-107694: Exposure of Sensitive Information to an Unauthorized Actor
The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.2.0 does not verify that the vendor a commission calculation is requested for is the requesting vendor, allowing vendors to disclose the commission rate and fixed fee the marketplace administrator...
WordPress MultiVendorX – WooCommerce Multivendor Marketplace AI Powered Solutions plugin <= 5.0.19 - Missing Authorization vulnerability
Missing Authorization vulnerability discovered by George Chen in WordPress Plugin MultiVendorX versions = 5.0.19...
CVE-2026-39794
Unauthenticated Broken Access Control in WooCommerce Multivendor Marketplace – REST API = 1.6.3 versions...
CVE-2026-39794 WordPress WooCommerce Multivendor Marketplace – REST API plugin <= 1.6.3 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in WooCommerce Multivendor Marketplace – REST API = 1.6.3 versions...