What’s New

A security release: seven fixes close off marketplace data that the wrong account could reach, across support tickets, verification, payouts, shipping, and staff.

Privacy and security

• Fix: Hardened Store Support so a ticket can only reference the customer’s own orders from that vendor.
• Fix: Patched a SQL injection vulnerability in vendor verification request sorting by accepting only ascending or descending order.
• Fix: Patched a PHP object injection vulnerability in product attributes meta when vendors save or open a product.
• Fix: Hardened MangoPay payout bank accounts so they can only be viewed or changed by their rightful owner.
• Fix: Stopped unpublished and deleted Product Q&A entries from appearing on the public REST endpoint.
• Fix: Hardened Distance Rate Shipping so vendors can only view their own settings.
• Fix: Patched a cross-site scripting vulnerability in the staff ID on the Vendor Staff edit form.

The vendor dashboard trades its profile completion bar for a store setup checklist, and four fixes keep add-ons, compliance fields, saved cards, and subscription downloads with their rightful owner.

Privacy and security

• Fix: Hardened EU compliance details so vendors can only save them on their own product variations.
• Fix: Hardened Product Add-ons so vendors can only view their global add-ons, not another vendor’s.
• Fix: Hardened MangoPay saved cards at checkout so they can only be viewed or deactivated by their owner.
• Fix: Hardened subscription downloads so vendors can only grant download access to their own products.

Vendor dashboard

• New: The profile completion bar on the new vendor dashboard and settings pages is now a store setup checklist that links straight to each remaining step, so vendors can see what is left and go do it.

Products

• Update: The legacy YITH WooCommerce Brands integration and its migration tool have been removed, since brands now run on WooCommerce’s native product brands.
• Fix: Global product add-ons now apply only to the products of the vendor who created them, on block-based cart and checkout pages too, so customers no longer see another vendor’s extras.

Admin tools

• Update: Integrations can now add their own summary cards to the Admin Earnings report, so marketplace owners see those figures alongside Dokan’s.

Two fixes clear a blank block editor and get products with no price loading again.

Payments

• Fix: Product pages with no price now load normally when Stripe Connect is enabled, with Express Checkout hidden on those products, so customers reach the page instead of an error.

Admin tools

• Fix: The block editor no longer opens blank while the Delivery Time module is active, because its settings assets now load only on Dokan admin pages.

The new vendor Store Settings page picks up opening hours, biography, and store category along with the module store options, and three security fixes tighten what vendors and non-admins can reach.

Privacy and security

• Fix: Restricted license refresh to administrators through an updated bundled Appsero client, so license actions stay with the marketplace owner.
• Fix: Restricted customer account updates through the REST API so vendors can no longer change a customer’s password.
• Fix: Patched a PHP object injection vulnerability in product meta data handled by the REST API.

Vendor dashboard

• New: The new vendor Store Settings page now accepts multiple opening hours per day, a store biography, and a store category, so vendors can show split trading hours and describe their store properly.
• Update: Module store options — Seller Vacation, store pickup, Live Chat, Store Support, Request for Quote, Order Min/Max cart limits, and EU compliance details — now open from the new vendor Store Settings page, so vendors set everything in one place.
• Fix: Vendor dashboard product pages now load normally with Dokan WPML active when the vendor’s subscription pack carries no category restriction, so those vendors can manage their products again.

Products

• Fix: New product tags that start with a number now save in the legacy product editor instead of being dropped, so numeric tags stay on the product.
• Orders and shipping
• Fix: Vendor cart minimum and maximum amounts now survive a store profile save that leaves those fields out, so Order Min/Max limits stay as the vendor set them.

Admin tools

• Fix: Dokan Pro modules now stay active after the nightly license check whenever the license is valid, so a working license no longer switches modules off overnight.

Dokan’s admin Settings is rebuilt around a new layout and reorganized menus, with every Lite and Pro module setting gathered into it and carried over automatically.

Payments

• Fix: Scheduled withdraw disbursements now run on the date shown in the vendor dashboard on sites outside UTC, with existing schedules adjusted automatically, so vendors are paid on the day they were promised.

Vendor dashboard

Fix: The daily vendor subscription check now sends an expiry alert to every vendor due one, so vendors hear about an expiring subscription in time to renew.

Admin tools

• New: The Dokan admin Settings has a redesigned layout and reorganized menus, so finding a given setting takes less hunting.
• New: Dokan Pro’s settings now live inside that same redesigned Settings area, with dedicated Shipment, Verification, and Social Onboarding pages, so Lite and Pro options sit together.
• Update: Every module’s settings — payment and withdraw methods, Delivery Time, Geolocation, Live Chat, Vendor Verification, Vendor Subscription, RMA, Wholesale, Store Support, Request for Quotation, and Printful — now open from the new Settings pages, so module options are no longer scattered across the admin.
• Update: Existing settings carry over automatically when the update runs, so nothing needs reconfiguring afterwards.