Unauthenticated Cross Site Scripting in Dokan Pro by WordPress
CVE-2026-65492

7.1HIGH

Key Information:

Vendor

WordPress
Status
Dokan Pro
Vendor
CVE Published:
23 July 2026

What is CVE-2026-65492?

The Dokan Pro plugin for WordPress contains an unauthenticated Cross Site Scripting (XSS) vulnerability that affects versions 5.0.0 and below. This vulnerability allows unauthorized users to inject malicious scripts into web pages, potentially compromising the security of affected sites. Attackers can exploit the flaw to execute harmful scripts in the context of users visiting the compromised site, leading to data breaches or unauthorized actions.

Affected Version(s)

Dokan Pro <= 5.0.0

References

https://patchstack.com/database/wordpress/plugin/dokan-pr...
vdb-entry

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

dutafi | Patchstack Bug Bounty Program
.