CVE-2022-3194: Dokan < 3.6.4 - Vendor Stored Cross-Site Scripting

Severity: medium (CVSS 5.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2024-01-16 · updated 2026-06-17
Weakness: CWE-79

Description

The Dokan WordPress plugin before 3.6.4 allows vendors to inject arbitrary javascript in product reviews, which may allow them to run stored XSS attacks against other users like site administrators.

Affected products

dokaninc Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy: before 3.6.4 — fixed in 3.6.4

How to fix

Upgrade to a fixed version: dokaninc Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy 3.6.4. Check the vendor advisory for mitigations.

References

https://wpscan.com/vulnerability/85e32913-dc2a-44c9-addd-7abde618e995/
https://wpscan.com/vulnerability/85e32913-dc2a-44c9-addd-7abde618e995/

Get alerted when CVE-2022-3194 or the next vulnerability affects your stack