EUVD-2026-117401

The Dokan WordPress plugin before 5.3.3 does not reconcile the amount credited to a vendor's reverse-withdrawal ledger against the amount actually collected for the payment order, allowing a vendor to clear their outstanding commission debt while paying less than the balance owed when a discount...

CVE-2026-107776

The Dokan WordPress plugin before version 5.3.3 contains a logic flaw where it fails to reconcile the amount credited to a vendor's reverse-withdrawal ledger against the actual amount collected for a payment order. This allows a vendor to clear their outstanding commission debt while paying less ...

CVE-2026-16577 Dokan < 5.0.14 - Vendor+ Reverse Withdrawal Ledger Manipulation via Client-Supplied Amount

The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.14 does not validate a client-supplied payment amount against the vendor's actual outstanding balance when recording a reverse-withdrawal payment, allowing a vendor to credit their reverse-withdrawal...