CVE-2022-3194

Dokan < 3.6.4 - Vendor Stored Cross-Site Scripting

The Dokan WordPress plugin before 3.6.4 allows vendors to inject arbitrary javascript in product reviews, which may allow them to run stored XSS attacks against other users like site administrators.

Affected

Dokan

CVSS v3.1 NVD

5.4 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

EPSS

0.49% chance of exploitation in the next 30 days, 41st percentile

Published

2024-01-16

Updated

2025-06-02

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/85e32913-dc2a-44c9-addd-7abde618e995/

Security advisories

• https://wpscan.com/vulnerability/85e32913-dc2a-44c9-addd-7abde618e995

References

• CVE Record
• NVD entry