EUVD-2026-39950
GHSA-wv47-9f7r-v6pj
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
PR:L reflects required vendor account; S:C captures script execution in victims' browsers outside the plugin's security context; no availability impact.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution - Build Your Own Amazon, eBay, Etsy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Product SKU in all versions up to, and including, 5.0.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with custom-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The malicious payload is delivered to site visitors - including unauthenticated users - when the store search widget inserts the unescaped AJAX response HTML into the DOM via jQuery's .html() method.
AnalysisAI
Stored Cross-Site Scripting in the Dokan WooCommerce Multivendor Marketplace plugin for WordPress (all versions through 5.0.4) allows any authenticated vendor-level user to permanently inject arbitrary JavaScript into product SKU fields, which then executes in the browsers of all site visitors - including unauthenticated users - via the store search widget's AJAX response path. The scope change (S:C in CVSS) is critical: the attacker plants the payload once as a vendor, but impact is borne by an unbounded population of end users who trigger the search widget. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis; however, the attack surface is wide on marketplaces with open vendor registration.
Technical ContextAI
Dokan Lite is a widely-used WooCommerce multivendor plugin maintained by dokaninc that enables WordPress sites to operate as marketplace platforms (analogous to Amazon or eBay). The vulnerability resides in includes/Product/Hooks.php - confirmed at lines L117, L137, and L161 in both the 4.3.3 and 5.0.3 tagged releases - where product SKU values submitted by vendor users are stored without adequate sanitization. The critical delivery mechanism is the store search widget, which issues an AJAX request and inserts the server response directly into the DOM using jQuery's .html() method. Because .html() parses and renders HTML, any stored script tags or event-handler attributes in the unescaped SKU field are executed in the victim's browser context. This is a classic CWE-79 (Improper Neutralization of Input During Web Page Generation) stored variant: the injection point is at write-time (SKU creation), the sink is the AJAX-to-DOM pipeline, and the execution context is entirely client-side. The CPE cpe:2.3:a:dokaninc:dokan confirms the affected product line.
RemediationAI
Update Dokan Lite to the version released after 5.0.4 containing changeset 3578095 from the WordPress plugin repository (https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3578095%40dokan-lite&new=3578095%40dokan-lite); the exact patched release version is not independently confirmed from the available data beyond the changeset reference, so administrators should verify the installed version against the latest available in the WordPress plugin directory. If immediate patching is not possible, the primary compensating control is to disable open vendor self-registration and audit all existing vendor accounts for suspicious SKU values already stored in the database - this does not eliminate the vulnerability but removes the unauthenticated registration path that makes exploitation trivial. Additionally, a Web Application Firewall rule blocking script-bearing input in SKU fields can serve as a secondary filter, though this should not substitute for patching. Site administrators should also review and sanitize existing product SKUs for stored payloads already injected prior to remediation, as patching alone will not remove previously stored malicious content.
The Dokan Pro plugin for WordPress is vulnerable to SQL Injection via the 'code' parameter in all versions up to, and in
The Dokan WordPress plugin before 3.7.6 does not properly sanitise and escape a parameter before using it in a SQL state
Improper access control in the Dokan WooCommerce Multivendor Marketplace WordPress plugin before 5.0.14 enables authenti
Dokan's WooCommerce multivendor marketplace WordPress plugin (versions before 5.0.11) exposes a broken object-level auth
Unauthenticated information disclosure in Dokan WooCommerce Multivendor Marketplace plugin (versions before 5.0.14) allo
Privilege escalation in Dokan (WordPress multivendor marketplace plugin) versions up to and including 5.0.1 enables any
An authentication bypass vulnerability exists in Dokan (Dokan, Inc.) dokan-lite plugin versions through 4.2.4 that allow
Privilege escalation in Dokan WordPress plugin versions 5.0.2 and earlier allows authenticated low-privileged customer a
Broken object-level authorization in the Dokan WordPress plugin (versions before 5.0.9) allows any authenticated vendor
Order ownership bypass in Dokan Multivendor for WordPress (versions before 5.0.9) allows any authenticated vendor to mod
The Dokan plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.0.8. Rate
PHP Object Injection in the Dokan Pro WordPress plugin (versions 5.0.2 and earlier) allows an authenticated user holding
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today