What’s New

A Black Friday upgrade page for Pro customers, a new “Stripe-managed Risk” option for Stripe Express, and a round of fixes across Stripe Connect payments, store reviews, and vendor permissions.

Payments

• Update: Stripe Express now has a “Stripe-managed Risk” setting, so vendors can connect on Stripe platforms where Stripe handles seller losses.
• Fix: Stripe Connect now asks vendors to add a store address before connecting and completes connect and disconnect without errors, so vendors can set up payouts without getting stuck.
• Fix: The Stripe Connect payment section now stays in place when the shipping method changes, and the Apple Pay and Google Pay buttons refresh on the cart page, so customers always have a working way to pay.
• Fix: Legacy Stripe Connect vendor subscription packs now renew at the full pack price when a coupon is used, so the marketplace collects the correct amount on every renewal.

Privacy and security

• Fix: Restricted cancelling a pending Vendor Verification request to the vendor who submitted it, so no vendor can cancel another vendor’s request.
• Fix: Restricted reading store reviews through the REST API to store admins, so review data is not exposed to anyone else.
• Fix: Hardened manual orders so vendors can only create them for their own customers and cannot change protected order meta, such as the commission.

Vendor dashboard

• Update: The vendor report filters now support WooCommerce 11.3, so reports keep filtering correctly on the latest WooCommerce.

Products

• Fix: Auction custom fields added with Product Form Manager now appear only on Simple Auction products, so every other product type keeps a clean form.

Orders and shipping

• Fix: The Country dropdown in vendor Distance Rate Shipping settings now opens above the rates table, so vendors can pick a country without the list being hidden.

Storefront

• Fix: A store’s rating now counts every published store review, not only the newest ones, so customers see an accurate score on the store page.

Admin tools

• New: A Black Friday upgrade page now offers Pro customers discounts on plan upgrades, mobile apps, and wePOS, so the seasonal offers are all in one place.
• Fix: The admin Store Reviews tab counts now follow the vendor filter and include pending reviews, so admins see accurate numbers while moderating.
• Fix: The admin header now shows the license plan name, such as Business 2 Year, instead of “Unlicensed”, so admins can confirm their license at a glance.

Stripe fees and refunds now add up correctly in every currency, the vendor dashboard follows the Dashboard Menu Manager, and five fixes keep vendors to their own customers, prices, products, and orders.

Payments

• Fix: Stripe Connect and Stripe Express now record the full Stripe fee, including the tax on Stripe fees, in vendor earnings, so earnings match what Stripe actually charged.
• Fix: The Stripe gateway fee is now correct when the store and the Stripe account use currencies with different decimals, such as yen and US dollars, so fees and earnings come out right.
• Fix: Stripe Connect refunds now reverse the correct amount from the vendor’s transfer in zero-decimal currencies such as yen, so a refund takes back exactly what was paid out.
• Fix: Block-based checkout now follows the Stripe Connect “Non-connected sellers” setting, so the setting applies on every checkout page.

Privacy and security

• Fix: Removed unused vendor selling status endpoints, so a vendor’s selling status can only change through Dokan Lite’s checks.
• Fix: Hardened Store Stats so only store admins can connect a Google Analytics account.
• Fix: Hardened Product Subscription so vendors can only view subscription details for their own customers.
• Fix: Hardened Wholesale so vendors can only save wholesale prices on their own product variations.
• Fix: Hardened product variations so vendors can only batch update variations of their own products.
• Fix: Hardened vendor orders so vendors can only load order items for their own orders.

Vendor dashboard

• Fix: The vendor profile completion card now counts only the settings pages enabled in the Dashboard Menu Manager and stays closed after “Done”, so the progress matches what vendors can actually fill in.
• Fix: Settings pages switched off in the Dashboard Menu Manager now stay restricted, and the vendor’s social links are hidden on the store page while “Social Profile” is off, so vendors and customers only see what the admin has enabled.
• Fix: Vendor Staff management now keeps working when the Vendor Staff role is missing, with a notice that tells admins to restore the role, so vendors can still manage their staff.

Products

• Fix: The “Other Available Vendor” list now skips deleted vendor copies of a product and hides when empty, and that vendor can sell the item again, so customers only see sellers they can actually buy from.

• Fix: Product Enquiry emails are now sent from the store’s address with the customer as Reply-To, so a vendor’s reply goes straight to the customer.

Admin tools

• Fix: The Commission tab on Dokan Subscription products is now hidden while Vendor Subscription is disabled, and its commission inputs have visible borders, so admins only see settings that apply.

A security release: seven fixes close off marketplace data that the wrong account could reach, across support tickets, verification, payouts, shipping, and staff.

Privacy and security

• Fix: Hardened Store Support so a ticket can only reference the customer’s own orders from that vendor.
• Fix: Patched a SQL injection vulnerability in vendor verification request sorting by accepting only ascending or descending order.
• Fix: Patched a PHP object injection vulnerability in product attributes meta when vendors save or open a product.
• Fix: Hardened MangoPay payout bank accounts so they can only be viewed or changed by their rightful owner.
• Fix: Stopped unpublished and deleted Product Q&A entries from appearing on the public REST endpoint.
• Fix: Hardened Distance Rate Shipping so vendors can only view their own settings.
• Fix: Patched a cross-site scripting vulnerability in the staff ID on the Vendor Staff edit form.

The vendor dashboard trades its profile completion bar for a store setup checklist, and four fixes keep add-ons, compliance fields, saved cards, and subscription downloads with their rightful owner.

Privacy and security

• Fix: Hardened EU compliance details so vendors can only save them on their own product variations.
• Fix: Hardened Product Add-ons so vendors can only view their global add-ons, not another vendor’s.
• Fix: Hardened MangoPay saved cards at checkout so they can only be viewed or deactivated by their owner.
• Fix: Hardened subscription downloads so vendors can only grant download access to their own products.

Vendor dashboard

• New: The profile completion bar on the new vendor dashboard and settings pages is now a store setup checklist that links straight to each remaining step, so vendors can see what is left and go do it.

Products

• Update: The legacy YITH WooCommerce Brands integration and its migration tool have been removed, since brands now run on WooCommerce’s native product brands.
• Fix: Global product add-ons now apply only to the products of the vendor who created them, on block-based cart and checkout pages too, so customers no longer see another vendor’s extras.

Admin tools

• Update: Integrations can now add their own summary cards to the Admin Earnings report, so marketplace owners see those figures alongside Dokan’s.

Two fixes clear a blank block editor and get products with no price loading again.

Payments

• Fix: Product pages with no price now load normally when Stripe Connect is enabled, with Express Checkout hidden on those products, so customers reach the page instead of an error.

Admin tools

• Fix: The block editor no longer opens blank while the Delivery Time module is active, because its settings assets now load only on Dokan admin pages.