Security Alert Summary
A stored cross-site scripting (XSS) vulnerability exists in the Dokan WooCommerce multivendor plugin that allows authenticated users with custom-level access and above to inject arbitrary JavaScript through the Product SKU field. The injected payload can be delivered to site visitors, including unauthenticated users, when the store search widget inserts an unescaped AJAX response into the page DOM.
CVE Details
- CVE ID:
CVE-2026-11783 - Affected component: Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy (Product SKU)
- Affected versions: All versions up to and including 5.0.4
- Published: June 27, 2026 at 08:16:44 AM UTC
- Last modified: June 27, 2026 at 08:16:44 AM UTC
- CVSS v3.1 base score: 6.4 (Medium)
- CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
- Attack vector / complexity: Network / Low
- Privileges required: Low (authenticated user with custom-level access or higher)
- User interaction: None
- Scope: Changed
- Impact: Confidentiality: Low; Integrity: Low; Availability: None
- Weakness (CWE): CWE-79 (Improper Neutralization of Input During Web Page Generation — Stored XSS)
Technical Details
The vulnerability is a stored cross-site scripting issue that arises from insufficient input sanitization and output escaping of the Product SKU field. Authenticated attackers with custom-level access and above can store malicious HTML/JavaScript in a product SKU. The store search widget later performs an AJAX request and inserts the returned HTML into the DOM using jQuery’s .html() method without proper escaping. Because the response HTML is inserted unescaped, the malicious script executes in the context of visitors who load the affected search results.
The root cause described is missing or inadequate sanitization on input and missing output escaping on the AJAX response before DOM insertion. The behavior specifically involves the store search widget and jQuery’s .html() insertion of an unescaped AJAX response.
How This Could Impact Your Website
On a site running the affected plugin, a contributor or external contractor who has custom-level access or higher could add or edit a product and include malicious script in the SKU. When other users or visitors use the store search or view search results, the injected script can run in their browsers. In a small business scenario this could lead to:
- Exposure of internal user details such as email addresses or other data accessible in the page context.
- Increased risk of targeted phishing or social engineering based on harvested user data or session information.
- Unwanted modifications to pages or UI seen by customers or staff, undermining trust.
If youre unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially contributor-level accounts and higher.
- Enforce strong passwords and two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins and themes.
- Monitor site activity and logs for unusual behavior, including unexpected product edits or search results.
If youd like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
References
- https://plugins.trac.wordpress.org/browser/dokan-lite/tags/4.3.3/includes/Product/Hooks.php#L117
- https://plugins.trac.wordpress.org/browser/dokan-lite/tags/4.3.3/includes/Product/Hooks.php#L137
- https://plugins.trac.wordpress.org/browser/dokan-lite/tags/4.3.3/includes/Product/Hooks.php#L161
- https://plugins.trac.wordpress.org/browser/dokan-lite/tags/5.0.3/includes/Product/Hooks.php#L117
- https://plugins.trac.wordpress.org/browser/dokan-lite/tags/5.0.3/includes/Product/Hooks.php#L137
- https://plugins.trac.wordpress.org/browser/dokan-lite/tags/5.0.3/includes/Product/Hooks.php#L161
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3578095%40dokan-lite&new=3578095%40dokan-lite&sfp_email=&sfph_mail=
- https://www.wordfence.com/threat-intel/vulnerabilities/id/21065544-8a48-485b-88af-2e638b400de4?source=cve
