Stored Cross-Site Scripting Vulnerability in Dokan Plugin for WordPress
CVE-2026-11783
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 27 June 2026
What is CVE-2026-11783?
The Dokan plugin for WordPress, specifically versions up to 5.0.4, is susceptible to a stored cross-site scripting vulnerability. Due to a lack of proper input sanitization and output escaping, authenticated users with custom-level access can inject arbitrary scripts via the Product SKU field. As a result, these malicious scripts may execute whenever an individual accesses the compromised page, potentially affecting all visitors, including unauthenticated users. The vulnerability arises when the compromised AJAX response is inserted into the DOM using jQuery’s .html() method, thereby exposing the site to severe security threats.
Affected Version(s)
Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy 0 <= 5.0.4