Dokan Pro CVE-2026-65492

Exploitation requires attacker-supplied input to reach a Dokan Pro <= 5.0.0 page that reflects or stores it without sanitization (CWE-79), and per the CVSS vector it requires victim user interaction (UI:R) - the target must load the crafted URL or view attacker-controlled content such as a malicious vendor field. No authentication is required by the attacker (PR:N), so the payload can be delivered unauthenticated, but impact is realized only when a user (ideally a privileged admin/vendor) triggers the injected script; the Changed scope (S:C) means the executed script can affect the wider site context. Limiting factors: the mandatory user interaction, the dependence on a running vulnerable Dokan Pro installation at version 5.0.0 or earlier, and only Low CIA impact per the vector. The description does not name the exact vulnerable parameter or state stored vs. reflected - verify the specific injection point against the Patchstack advisory.

Signals are moderate and partly limited: the CVSS 3.1 base score is 7.1 (High) driven by network reach (AV:N), low attack complexity (AC:L), no privileges required (PR:N), and a Changed scope (S:C), but tempered by required user interaction (UI:R) and only Low impact to confidentiality, integrity, and availability (C:L/I:L/A:L). No EPSS score, no CISA KEV listing, and no POC were supplied, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The PR:N/UI:R combination is typical of XSS where an attacker must lure or influence a victim rather than exploit fully autonomously, so real-world risk is opportunistic rather than wormable. Note a gap: the description does not specify whether the XSS is stored or reflected, which materially changes exploitability - stored XSS in a vendor-facing field would be substantially more dangerous than a reflected variant; verify the injection point with the Patchstack advisory.

An attacker crafts a malicious link or input containing a JavaScript payload targeting a vulnerable Dokan Pro parameter and lures a logged-in administrator or vendor into visiting it (UI:R). When the page renders the unsanitized input, the script executes in the victim's authenticated session, and because scope is Changed the attacker can act against the broader WordPress site - for example stealing session cookies or performing actions as the victim. No public exploit identified at time of analysis.