CVE-2026-11783: Dokan WordPress Plugin XSS Vulnerability

CVE-2026-11783 Overview

CVE-2026-11783 is a stored Cross-Site Scripting (XSS) vulnerability [CWE-79] in the Dokan: AI Powered WooCommerce Multivendor Marketplace Solution plugin for WordPress. The flaw affects all versions up to and including 5.0.4. It stems from insufficient input sanitization and output escaping in the Product SKU field. Authenticated attackers with custom-level access or higher can inject arbitrary JavaScript that executes when visitors interact with the store search widget. The malicious payload is rendered when the widget inserts unescaped AJAX response HTML into the DOM via jQuery's .html() method.

Critical Impact
Stored JavaScript payloads execute in the browsers of all site visitors, including unauthenticated users, enabling session theft, credential harvesting, and marketplace-wide account compromise.

Affected Products

Dokan Lite plugin for WordPress versions up to and including 5.0.4
WooCommerce multivendor marketplaces relying on the Dokan store search widget
WordPress sites where vendor accounts (custom-level access or above) can create products

Discovery Timeline

2026-06-27 - CVE-2026-11783 published to NVD
2026-06-29 - Last updated in NVD database

Technical Details for CVE-2026-11783

Vulnerability Analysis

The vulnerability resides in the Dokan Lite product hooks located in includes/Product/Hooks.php. Vendor-supplied Product SKU values are stored without adequate sanitization. When the store search widget queries products via AJAX, the server returns HTML containing the raw SKU. The client-side widget then injects this response into the DOM using jQuery's .html() method, which parses and executes any embedded <script> tags or event handlers.

Because the payload persists in the database and executes for every visitor who triggers the widget, the vulnerability qualifies as stored XSS with a changed scope. Unauthenticated site visitors are affected even though the initial injection requires authentication.

Root Cause

Two defects combine to produce the vulnerability. First, the plugin fails to sanitize the SKU input on write to the product record. Second, the AJAX response handler renders the SKU into HTML without escaping and delivers it to a sink (.html()) that interprets markup. Either proper server-side escaping with esc_html() or client-side use of .text() would neutralize the payload.

Attack Vector

An attacker with vendor privileges creates or edits a product and inserts a JavaScript payload into the SKU field. When any site visitor uses the store search widget and the vendor's product appears in the results, the payload executes in the visitor's browser under the site's origin. Attackers can steal session cookies, pivot to administrator accounts, redirect users to phishing pages, or perform actions on behalf of authenticated shoppers and administrators.

No verified public exploit code is available. Technical details are documented in the Wordfence Vulnerability Report and the WordPress Dokan Lite Changeset.

Detection Methods for CVE-2026-11783

Indicators of Compromise

Product SKU fields containing HTML tags, <script> blocks, or JavaScript event handlers such as onerror= or onload=.
Unexpected outbound requests from visitor browsers to attacker-controlled domains originating from marketplace pages.
Database rows in wp_postmeta where _sku values contain characters like <, >, ", or backticks.
Store search widget responses returning HTML with executable script content.

Detection Strategies

Audit the WordPress wp_postmeta table for _sku entries containing suspicious markup or script keywords.
Enable Content Security Policy (CSP) reporting to capture blocked inline script executions on marketplace pages.
Review web server access logs for POST requests to Dokan vendor product endpoints followed by anomalous GET traffic to /dokan/store-search style AJAX handlers.

Monitoring Recommendations

Monitor vendor account activity, especially newly registered custom-role accounts that immediately create or edit products.
Alert on WordPress admin sessions that follow visitor requests to product search pages, which may indicate cookie exfiltration.
Track modifications to plugin files under wp-content/plugins/dokan-lite/ outside of scheduled update windows.

How to Mitigate CVE-2026-11783

Immediate Actions Required

Update the Dokan Lite plugin to a version released after 5.0.4 that includes the fix referenced in changeset 3578095.
Audit all existing product SKU values across vendor accounts and remove any containing HTML or JavaScript syntax.
Restrict vendor registration and require manual approval for new custom-role accounts on the marketplace.
Rotate WordPress administrator credentials and invalidate active sessions if malicious SKUs are discovered.

Patch Information

The fix is documented in the WordPress Dokan Lite Changeset. Site administrators should upgrade Dokan Lite to the patched release through the WordPress plugin dashboard. Refer to the vulnerable code paths at lines 117, 137, and 161 in the Hooks.php reference to verify the fix has been applied.

Workarounds

Disable the Dokan store search widget until the plugin is updated.
Deploy a Web Application Firewall (WAF) rule that blocks POST requests containing <script, onerror=, or javascript: patterns in SKU parameters.
Enforce a strict Content Security Policy that disallows inline scripts on public-facing marketplace pages.
Reduce vendor role permissions to the minimum required and revoke custom-level access from untrusted accounts.

bash

# Example WAF rule (ModSecurity) to block script payloads in Dokan product SKU submissions
SecRule ARGS:_sku "@rx (?i)(<script|onerror=|onload=|javascript:)" \
    "id:1026011783,phase:2,deny,status:403,\
    msg:'CVE-2026-11783 Dokan SKU XSS attempt blocked',\
    logdata:'Matched SKU payload: %{MATCHED_VAR}'"