Skip to content
Sign in
5.4 Medium

CVE-2022-3194 The Dokan WordPress plugin before 3.6.4 allows vendors to inject arbitrary javascript in product reviews, which may…

Description

The Dokan WordPress plugin before 3.6.4 allows vendors to inject arbitrary javascript in product reviews, which may allow them to run stored XSS attacks against other users like site administrators.

Affected products and versions

Product Affected versions Fixed in
Dokan 3.6 earliest → < 3.6.4 3.6.4

Other CVEs of Dokan

The 3 CVEs of Dokan →
CVE-2026-107776 Dokan < 5.3.3 - Vendor+ Reverse Withdrawal Ledger Credit Without Payment via Discount Coupon 2.2 Low CVE-2022-3915 The Dokan WordPress plugin before 3.7.6 does not properly sanitise and escape a parameter before using it in a SQL… 9.8 Critical
Track this CVE