CVE-2022-3194

Dokan < 3.6.4 - Vendor Stored Cross-Site Scripting

Medium · published January 16, 2024

CVSS v3.1
5.4
EPSS
0%
Percentile
41.2
In the wild
Unconfirmed
What it is

The Dokan WordPress plugin before 3.6.4 allows vendors to inject arbitrary javascript in product reviews, which may allow them to run stored XSS attacks against other users like site administrators.

The record
Technical detail
CVSS v3.1
5.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00491 · 41.2th percentile
Published
2024-01-16T15:53Z
EPSS history
Timeline
  • 16 JAN 15:53Z
    Dokan < 3.6.4 - Vendor Stored Cross-Site Scripting
    cvelistv5