Bhaveshkumar Parmar

**Name of the Vulnerable Software and Affected Versions** WC Vendors versions prior to 2.7.2.1 **Description** An issue exists where the plugin fails to verify if the vendor submitting a front-end order shipment status change is the actual owner of the referenced order. This allows any authenticated vendor to mark orders belonging to other vendors as shipped, create order notes falsely attributed to another vendor, and trigger shipment notification emails to customers. **Recommendations** Update WC Vendors to version 2.7.2.1 or later.

**Name of the Vulnerable Software and Affected Versions** Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin versions prior to 5.0.14 **Description** The plugin fails to validate a client-supplied payment amount against the vendor's actual outstanding balance during the recording of a reverse-withdrawal payment. This allows a vendor to credit their reverse-withdrawal ledger with an arbitrary amount, effectively clearing their commission debt without making the actual payment. **Recommendations** Update the plugin to version 5.0.14 or later.