The Dokan WordPress plugin, widely used for creating multi-vendor marketplaces, had a security flaw that could allow malicious vendors to harm website visitors and administrators. This vulnerability, known as Stored Cross-Site Scripting (XSS), meant that a vendor could embed harmful code, specifically JavaScript, into product reviews. When other users, including site administrators, viewed these compromised reviews, the hidden code would automatically run in their web browsers. This could lead to various attacks, such as stealing sensitive information, redirecting users to malicious websites, or taking control of their accounts.
CVE Details
- Product: Dokan WordPress Plugin
- Published: January 16, 2024
- Severity: Medium
- Status: Analyzed
Affected Products
The Dokan WordPress plugin, specifically the ‘lite’ version, is affected by this issue.
- Dokan WordPress plugin before version 3.6.4
Current Status
This vulnerability has been thoroughly analyzed. Details regarding its nature and impact are publicly available, allowing users to understand the risks and take appropriate actions.
Severity Level
The Common Vulnerability Scoring System (CVSS) assigns a score of 5.4 to this vulnerability, classifying it as “Medium” severity. This rating indicates that while the vulnerability is not the most critical, it still poses a significant risk. An attacker can exploit it remotely without needing special access, but it typically requires some user interaction (like viewing a malicious product review) for the attack to succeed. Successful exploitation could lead to a loss of confidentiality and integrity for affected users.
Possible Solutions
The good news is that a fix is available for this vulnerability. To protect your WordPress marketplace running the Dokan plugin, it is crucial to update to a patched version immediately.
- Update to Dokan version 3.6.4 or later. This version contains the necessary security patches to prevent XSS attacks through product reviews.
- Always ensure your WordPress core, themes, and all plugins are kept up-to-date to mitigate known vulnerabilities.
- Regularly review and sanitize user-generated content, especially in areas like product reviews, although a proper patch should handle this automatically.
References
https://wpscan.com/vulnerability/85e32913-dc2a-44c9-addd-7abde618e995/
