What is the CVSS score of EUVD-2026-48103?

EUVD-2026-48103 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

Which versions of Dokan Pro are affected by EUVD-2026-48103?

Dokan Pro WordPress multivendor marketplace plugin (versions through 5.0.0) contains a stored/reflected cross-site scripting vulnerability allowing unauthenticated attackers to inject malicious…

How to fix or mitigate EUVD-2026-48103?

Within 24 hours: Audit your WordPress installation to identify whether Dokan Pro is deployed and confirm version status (≤5.0.0 is vulnerable). Within 7 days: If non-critical to operations, disable and remove the plugin; otherwise, deploy Web Application Firewall rules to block XSS payloads, restrict marketplace access to authenticated users only, and implement Content Security Policy headers to prevent inline script execution. Within 30 days: Monitor Patchstack and vendor security advisories for a released patch and prepare to upgrade immediately upon availability.

Dokan Pro EUVD-2026-48103

| CVE-2026-65492 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-07-23 Patchstack

GHSA-r68j-6px2-hp4p

WordPress XSS Wordpress Plugin Dokan Pro

7.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

7.1 HIGH

Unauthenticated network-delivered XSS needing victim interaction (UI:R); Changed scope reflects script executing in the broader site context with limited CIA impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 12:32 vuln.today

CVE Published

Jul 23, 2026 - 11:18 cve.org

HIGH 7.1

DescriptionCVE.org

Unauthenticated Cross Site Scripting (XSS) in Dokan Pro <= 5.0.0 versions.

AnalysisAI

Stored/reflected Cross-Site Scripting in the Dokan Pro WordPress multivendor marketplace plugin (versions up to and including 5.0.0) lets remote unauthenticated attackers inject JavaScript that executes in a victim's browser session, with no public exploit identified at time of analysis. Because the CVSS scope is marked Changed (S:C), successful execution can affect resources beyond the vulnerable component - e.g. hijacking an authenticated admin or vendor session in the surrounding WordPress site. The flaw was reported by Patchstack and requires victim user interaction (UI:R) to trigger.

Technical ContextAI

Dokan Pro is the commercial extension of the widely used Dokan multivendor marketplace plugin for WordPress/WooCommerce, adding vendor storefronts, subscriptions, and reporting features. The affected component is identified by CPE cpe:2.3:a:dokan_wordpress_plugin:dokan_pro:*:*:*:*:*:*:*:* covering all builds through 5.0.0. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), meaning user-controllable input is reflected or stored into an HTML response without adequate output encoding or input sanitization, allowing an attacker-supplied <script> or event-handler payload to be parsed as active content by the browser.

RemediationAI

Upgrade Dokan Pro to a release later than 5.0.0 once the vendor (weDevs) publishes a fixed version; the supplied data lists no exact fixed version, so this is patch available per vendor advisory - confirm the specific patched build via the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/dokan-pro/vulnerability/wordpress-dokan-pro-plugin-5-0-0-cross-site-scripting-xss-vulnerability before deploying. Until a patched version is confirmed and installed, apply a Web Application Firewall or virtual patch (Patchstack offers one) to filter script/event-handler payloads on Dokan endpoints, restrict access to vendor and admin dashboard pages to trusted users, and enforce a restrictive Content-Security-Policy that blocks inline script execution to blunt payload impact - noting that a strict CSP can break legitimate inline scripts used by themes/plugins and requires testing. Educate administrators and vendors not to open unsolicited links pointing at the store, since exploitation requires user interaction.