CVE-2026-11783: Dokan WordPress Plugin Stored XSS in Product SKU (v5.0.4 and Earlier)

Technical summary

CVE-2026-11783 is a Stored XSS vulnerability affecting Dokan versions up to 5.0.4. The vulnerability stems from insufficient input sanitization of the Product SKU field and inadequate output escaping when the search widget renders AJAX responses. The widget uses jQuery's .html() method to insert unescaped HTML into the DOM, allowing authenticated attackers (custom-level access and above) to persist arbitrary JavaScript payloads. The payload executes in the context of all subsequent page visitors, including anonymous users, achieving a cross-site boundary impact (CVSS vector includes S:C).

Business impact

A compromised Dokan store becomes a vector for customer credential theft, payment interception, and malware distribution. Attackers can harvest customer sessions, inject fake checkout redirects, or display phishing content. Multivendor platforms are high-value targets because a single XSS payload affects all store visitors and potentially all vendor accounts. Reputational damage is significant: customers may lose trust in the marketplace's security. PCI DSS compliance is at risk if payment-related data or sessions are harvested.

Affected systems

All WordPress installations running Dokan plugin versions up to and including 5.0.4 are affected. The vulnerability requires the attacker to have authenticated access with custom-level privileges or higher—ruling out purely anonymous attacks but affecting vendor accounts, admin accounts, and any user role with product management capabilities. Multivendor sites with numerous vendors face broader attack surface if any vendor account is compromised.

Exploitability

Exploitability is moderate. The attack requires authenticated access, which limits the immediate threat from external actors but elevates risk from insider threats, compromised vendor accounts, or brute-forced credentials. Once authenticated, the SKU field is trivial to modify during product creation or editing. No user interaction is needed for the payload to execute on visitor browsers—it triggers automatically via the search widget, making it particularly dangerous for high-traffic stores. The attack scales automatically: every store visitor becomes a potential victim.

Remediation

Upgrade the Dokan plugin to a patched version beyond 5.0.4 (verify against the official vendor advisory for the exact version number). The patch should include proper input sanitization of the SKU field and output escaping when rendering AJAX responses. As an interim measure, restrict custom-level access to trusted users and monitor product SKU modifications. Consider disabling the search widget or implementing a Web Application Firewall rule to block unusual SKU content until patching is complete.

Patch guidance

Update Dokan through the WordPress admin dashboard or via direct download from the vendor. After patching, review recent product modifications—particularly SKU fields—for suspicious or encoded content that may indicate exploitation attempts. Test the search widget functionality post-patch to confirm no regression. For large multivendor marketplaces, stage the update in a test environment first, as plugin interactions with custom product fields vary by configuration.

Detection guidance

Search WordPress plugin logs and database audit trails for modifications to product SKU fields, especially by vendor accounts with minimal prior activity. Look for SKU values containing HTML tags, JavaScript keywords (script, onerror, onclick), or URL-encoded payloads. Monitor AJAX responses from the search widget for unexpected script tags using a WAF or request inspection tool. Check browser developer tools on the frontend for console errors or injected script tags following search queries. Review user session logs for mass access to the search widget from unusual geographic locations.

Why prioritize this

Medium CVSS (6.4) reflects the authentication requirement, but the stored nature of the XSS, automatic execution via search widget, and cross-site boundary impact elevate real-world risk. Multivendor platforms with active customer bases should prioritize this immediately. Stores with weak vendor account security or minimal technical monitoring should treat this as high priority. Not yet in CISA KEV, but that status should not inform prioritization—the vulnerability is trivially exploitable by any authenticated user and directly exposes customer data.

Risk score, explained

CVSS 6.4 (MEDIUM) is assigned: Attack Vector Network, Access Complexity Low (any authenticated user can inject via product edit), Privileges Required (L—authenticated with custom-level or higher access), User Interaction None, Scope Changed (C—affects other users and unauthenticated visitors), Confidentiality Impact Low, Integrity Impact Low, Availability None. The 'Scope Changed' rating reflects that the XSS crosses privilege boundaries (vendor→customer). In practice, organizations with mature incident response and customer-facing multivendor models may score this as higher due to business impact and scale of exposure.

Frequently asked questions