Arbitrary JavaScript Injection in Dokan WordPress Plugin Allows Stored XSS Attacks

CVE-2022-3194 · MEDIUM Severity

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

The Dokan WordPress plugin before 3.6.4 allows vendors to inject arbitrary javascript in product reviews, which may allow them to run stored XSS attacks against other users like site administrators.

Learn more about our Wordpress Pen Testing.