PLUGIN SECURITY
Is Dokan Lite safe?
Transform your WooCommerce site into a multivendor marketplace with Dokan – an AI powered & advanced WooCommerce marketplace solution
What this plugin does
- Slug:
dokan-lite - Author: Dokan, Inc.
- 30000+ active installs
- 92/100 rating (767 reviews on wordpress.org)
- 4514229 all-time downloads
- On WordPress.org since 2015-01-24
multi sellermulti vendormultivendormultivendor marketplacewoocommerce multivendor marketplace
Maintenance status
- Latest known version: 5.0.12
- Last updated: 2026-09-07 12:08pm GMT
- Tested up to WordPress: 7.1
- Requires PHP: 7.4+
Known vulnerabilities
32 known CVEs on file for Dokan Lite. Reported between 2020 and 2026.
| CVE | Vulnerability | Type | Severity | Affected | Fixed in | Published | Status |
|---|---|---|---|---|---|---|---|
| CVE-2026-16577 | Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy [dokan-lite] < 5.0.14 | Incorrect Authorization | Unknown | < 5.0.14 | 5.0.14 | 2026-08-21 | ⚠ update needed |
| CVE-2026-16576 | Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy [dokan-lite] < 5.0.14 | Improper Access Control | Unknown | < 5.0.14 | 5.0.14 | 2026-08-21 | ⚠ update needed |
| CVE-2026-16575 | Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy [dokan-lite] < 5.0.14 | Exposure of Sensitive Information to an Unauthorized Actor | Unknown | < 5.0.14 | 5.0.14 | 2026-08-21 | ⚠ update needed |
| CVE-2026-16574 | Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy [dokan-lite] < 5.0.11 | Authorization Bypass Through User-Controlled Key | Unknown | < 5.0.11 | 5.0.11 | 2026-08-08 | ✓ fixed in latest |
| CVE-2026-8761 | Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy [dokan-lite] < 5.0.3 | Missing Authorization | High 8.8 | < 5.0.3 | 5.0.3 | 2026-08-04 | ✓ fixed in latest |
| CVE-2026-16565 | Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy [dokan-lite] < 5.0.9 | Authorization Bypass Through User-Controlled Key | Unknown | < 5.0.9 | 5.0.9 | 2026-08-03 | ✓ fixed in latest |
| CVE-2026-16564 | Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy [dokan-lite] < 5.0.9 | Authorization Bypass Through User-Controlled Key | Unknown | < 5.0.9 | 5.0.9 | 2026-08-03 | ✓ fixed in latest |
| CVE-2026-66699 | Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy [dokan-lite] < 5.0.11 | Missing Authorization | Medium 5.3 | < 5.0.11 | 5.0.11 | 2026-07-29 | ✓ fixed in latest |
+ 20 more known vulnerabilities
| CVE | Vulnerability | Type | Severity | Affected | Fixed in | Published | Status |
|---|---|---|---|---|---|---|---|
| CVE-2026-57706 | Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy [dokan-lite] < 5.0.7 | — | High 7.1 | < 5.0.7 | 5.0.7 | 2026-07-10 | ✓ fixed in latest |
| CVE-2026-11783 | Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy [dokan-lite] < 5.0.5 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.4 | < 5.0.5 | 5.0.5 | 2026-06-26 | ✓ fixed in latest |
| CVE-2026-11987 | Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy [dokan-lite] < 5.0.5 | Authorization Bypass Through User-Controlled Key | Medium 4.3 | < 5.0.5 | 5.0.5 | 2026-06-26 | ✓ fixed in latest |
| CVE-2026-10023 | Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy [dokan-lite] < 5.0.4 | Authorization Bypass Through User-Controlled Key | Medium 4.3 | < 5.0.4 | 5.0.4 | 2026-06-17 | ✓ fixed in latest |
| CVE-2026-49780 | Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy [dokan-lite] < 5.0.3 | Incorrect Privilege Assignment | High 8.8 | < 5.0.3 | 5.0.3 | 2026-06-03 | ✓ fixed in latest |
| CVE-2026-3504 | Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy [dokan-lite] < 4.3.2 | Exposure of Sensitive Information to an Unauthorized Actor | Medium 5.3 | < 4.3.2 | 4.3.2 | 2026-05-01 | ✓ fixed in latest |
| CVE-2026-24359 | Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy [dokan-lite] < 4.2.5 | Authentication Bypass Using an Alternate Path or Channel | High 8.8 | < 4.2.5 | 4.2.5 | 2026-03-16 | ✓ fixed in latest |
| CVE-2025-14977 | Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy [dokan-lite] < 4.2.5 | Improper Access Control | High 8.1 | < 4.2.5 | 4.2.5 | 2026-01-19 | ✓ fixed in latest |
| CVE-2025-53425 | Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy [dokan-lite] < 4.1.4 | Incorrect Privilege Assignment | High 7.2 | < 4.1.4 | 4.1.4 | 2025-09-20 | ✓ fixed in latest |
| CVE-2021-4342 | Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy [dokan-lite] < 3.2.1 | — | Unknown | < 3.2.1 | 3.2.1 | 2023-06-07 | ✓ fixed in latest |
| CVE-2023-34382 | Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy [dokan-lite] < 3.7.20 | Deserialization of Untrusted Data | Medium 4.4 | < 3.7.20 | 3.7.20 | 2023-06-07 | ✓ fixed in latest |
| CVE-2023-26525 | Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy [dokan-lite] < 3.7.13 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | High 7.1 | < 3.7.13 | 3.7.13 | 2023-03-02 | ✓ fixed in latest |
| CVE-2022-3915 | Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy [dokan-lite] < 3.7.6 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | Critical 9.8 | < 3.7.6 | 3.7.6 | 2022-11-21 | ✓ fixed in latest |
| CVE-2022-3194 | Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy [dokan-lite] < 3.6.6 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 5.4 | < 3.6.6 | 3.6.6 | 2022-09-13 | ✓ fixed in latest |
| — | Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy [dokan-lite] < 3.2.1 | — | Unknown | < 3.2.1 | 3.2.1 | 2021-03-01 | ✓ fixed in latest |
| — | Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy [dokan-lite] < 3.0.9 | — | Unknown | < 3.0.9 | 3.0.9 | 2020-09-16 | ✓ fixed in latest |
| CVE-2020-36748 | Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy [dokan-lite] < 3.0.9 | Cross-Site Request Forgery (CSRF) | Medium 4.3 | < 3.0.9 | 3.0.9 | 2020-09-16 | ✓ fixed in latest |
| — | Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy [dokan-lite] < 3.2.1 | — | Unknown | < 3.2.1 | 3.2.1 | — | ✓ fixed in latest |
| CVE-2020-36707, CVE-2021-4417, CVE-2020-36752, CVE-2020-36757, CVE-2020-36756, CVE-2020-36761, CVE-2020-36760, CVE-2020-36760 | Multiple Plugins/Themes - Cross-Site Request Forgery (CSRF) | — | Unknown | < 3.0.9 | 3.0.9 | — | ✓ fixed in latest |
| CVE-2021-4414, CVE-2021-4425 | Multiple Plugins - CSRF Nonce Bypasses | — | Unknown | < 3.2.1 | 3.2.1 | — | ✓ fixed in latest |
How to fix it
Keep Dokan Lite updated — 5.0.12 is the latest version on wordpress.org, and each CVE above lists the exact release that fixed it ("Fixed in").
This is the plugin's full known vulnerability history, not a scan of any specific installation — run a free scan of your own site to check your exact installed version.
Safer / more established alternatives
- WCFM – Frontend Manager for WooCommerce — 20000+ active installs — 90/100 (286) — max PHP 8.4
- WCFM Marketplace – Multivendor Marketplace for WooCommerce — 10000+ active installs — 92/100 (448) — max PHP 8.4
- WCFM Membership – WooCommerce Memberships for Multivendor Marketplace — 10000+ active installs — 80/100 (25) — max PHP 8.4
- WC Vendors – WooCommerce Multivendor, WooCommerce Marketplace, Product Vendors — 3000+ active installs — 90/100 (188)
- MultiVendorX – WooCommerce Multivendor Marketplace AI Powered Solutions — 2000+ active installs — 96/100 (432)
Check your own WordPress site
Run a free passive scan now, or create a free account and install the WP Clinic plugin for a deep scan of your whole hosting account and AI-assisted repair.