{"id":"CVE-2022-3194","aliases":["EUVD-2022-42611","GHSA-5g8x-4pjj-p6fm"],"status":"published","title":"Dokan \u003c 3.6.4 - Vendor Stored Cross-Site Scripting","description":"The Dokan WordPress plugin before 3.6.4 allows vendors to inject arbitrary javascript in product reviews, which may allow them to run stored XSS attacks against other users like site administrators.","severity":{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.00491,"percentile":0.42474,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-79"],"published":"2024-01-16T15:53:36Z","modified":"2026-10-28T02:30:46Z","products":[{"vendor":"dokan","product":"dokan"},{"vendor":"dokan, inc.","product":"dokan"},{"vendor":"unknown","product":"dokan"}],"references":[{"url":"https://wpscan.com/vulnerability/85e32913-dc2a-44c9-addd-7abde618e995/","tags":["exploit","vdb-entry","technical-description","x_transferred","Exploit","Third Party Advisory","evidence"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-3194","tags":["advisory"]},{"url":"https://wpscan.com/vulnerability/85e32913-dc2a-44c9-addd-7abde618e995"},{"url":"https://github.com/advisories/GHSA-5g8x-4pjj-p6fm"},{"url":"https://wordpress.org/plugins","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/3xxx/CVE-2022-3194.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2022-3194","title":"Dokan \u003c 3.6.4 - Vendor Stored Cross-Site Scripting","description":"The Dokan WordPress plugin before 3.6.4 allows vendors to inject arbitrary javascript in product reviews, which may allow them to run stored XSS attacks against other users like site administrators.","status":"published","published":"2024-01-16T15:53:36.5Z","modified":"2025-06-02T15:10:22.999Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"adp"}],"updated_at":"2026-11-02T14:34:33.24035Z"}],"euvd":[{"id":"EUVD-2022-42611","description":"The Dokan WordPress plugin before 3.6.4 allows vendors to inject arbitrary javascript in product reviews, which may allow them to run stored XSS attacks against other users like site administrators.","status":"published","published":"2024-01-16T15:53:36Z","modified":"2025-06-02T15:10:22Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T20:32:33.292081Z"}],"ghsa":[{"id":"GHSA-5g8x-4pjj-p6fm","title":"The Dokan WordPress plugin before 3.6.4 allows vendors to inject arbitrary javascript in product...","description":"The Dokan WordPress plugin before 3.6.4 allows vendors to inject arbitrary javascript in product reviews, which may allow them to run stored XSS attacks against other users like site administrators.","status":"published","published":"2024-01-16T18:31:09Z","modified":"2025-06-02T18:31:31Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:02:32.017383Z"}],"nvd":[{"id":"CVE-2022-3194","description":"The Dokan WordPress plugin before 3.6.4 allows vendors to inject arbitrary javascript in product reviews, which may allow them to run stored XSS attacks against other users like site administrators.","status":"published","published":"2024-01-16T16:15:09.883Z","modified":"2026-06-17T04:59:02.8Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"},{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:07:40.49892Z"}],"osv":[{"id":"CVE-2022-3194","title":"Dokan \u003c 3.6.4 - Vendor Stored Cross-Site Scripting","description":"The Dokan WordPress plugin before 3.6.4 allows vendors to inject arbitrary javascript in product reviews, which may allow them to run stored XSS attacks against other users like site administrators.","status":"published","published":"2024-01-16T15:53:36.5Z","modified":"2026-10-28T02:30:46.793073125Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:25.860945Z"}]}}