What is the CVSS score of CVE-2026-57706?

CVE-2026-57706 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.3%.

Which versions of Dokan are affected by CVE-2026-57706?

The Dokan WordPress multivendor plugin (versions ≤5.0.6) contains a reflected XSS vulnerability enabling attackers to execute malicious scripts in users' browsers through crafted links, potentially…

How to fix or mitigate CVE-2026-57706?

Within 24 hours, audit all WordPress installations for Dokan versions up to 5.0.6 and disable the plugin if operationally feasible. During the first 7 days, deploy Web Application Firewall rules to filter script injection attempts targeting Dokan endpoints and enable comprehensive logging of vendor and administrator activities. Within 30 days, monitor Patchstack advisories for patch availability; apply the vendor patch upon release or plan migration to an alternative multivendor marketplace plugin if no patch is forthcoming.

Dokan CVE-2026-57706

EUVD-2026-43361 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-07-13 Patchstack

WordPress XSS Dokan Wordpress Plugin Dokan Inc

7.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

6.1 MEDIUM

Reflected XSS is network-delivered with low complexity and no privileges but needs victim clicks (UI:R); script escaping into browser context gives S:C with low C/I, and availability impact does not realistically apply (A:N).

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 13, 2026 - 10:50 vuln.today

CVE Published

Jul 13, 2026 - 08:41 cve.org

HIGH 7.1

DescriptionCVE.org

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dokan, Inc. Dokan dokan-lite allows Reflected XSS.This issue affects Dokan: from n/a through <= 5.0.6.

AnalysisAI

Reflected cross-site scripting in the Dokan (dokan-lite) WordPress multivendor marketplace plugin, versions up to and including 5.0.6, lets a remote attacker inject script that executes in a victim's browser when they follow a crafted link. Reported by Patchstack (CWE-79) and rated CVSS 7.1, the scope-changed vector reflects that injected script runs in the user's authenticated WordPress session context. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV; exploitation requires the target to click an attacker-supplied URL.

Technical ContextAI

Dokan is a widely used WordPress plugin that turns a site into a multi-vendor e-commerce marketplace (vendor dashboards, storefronts, product listings). The affected component is identified by CPE cpe:2.3:a:dokan,_inc.:dokan:*:*:*:*:*:*:*:* covering all versions through 5.0.6. The root cause is CWE-79, Improper Neutralization of Input During Web Page Generation: a request parameter is reflected back into an HTML response without proper output encoding or sanitization, so attacker-controlled input is parsed as active markup/JavaScript by the victim's browser. Because it is reflected (non-persistent), the malicious payload travels in the request itself rather than being stored server-side.

RemediationAI

Upgrade the Dokan plugin to a fixed release newer than 5.0.6; the input data does not specify an exact patched version, so no vendor-released patch version is independently confirmed here - consult the Patchstack advisory (https://patchstack.com/database/Wordpress/Plugin/dokan-lite/vulnerability/wordpress-dokan-plugin-5-0-6-cross-site-scripting-xss-vulnerability) and the plugin's WordPress.org changelog for the corrected version and update immediately. Until a confirmed patch is applied, deploy a Web Application Firewall rule (Patchstack's virtual patch, or WordPress security plugins such as Wordfence) to filter reflected XSS payloads on the affected parameter, which adds latency and can produce false positives on legitimate rich input. As additional compensating controls, set a restrictive Content-Security-Policy header to limit inline script execution (may break themes/plugins that rely on inline JS) and instruct administrators and vendors to avoid clicking untrusted links to the site while unpatched.