CVE-2022-3194 Dokan < 3.6.4 - Vendor Stored Cross-Site Scripting
Vendors can inject arbitrary JavaScript into product reviews, enabling stored XSS attacks against site administrators and other users.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2022-3194?
CVE-2022-3194 is a medium-severity cross-site scripting vulnerability in Unknown Dokan, published on 16 Jan 2024. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
The Dokan WordPress plugin before 3.6.4 allows vendors to inject arbitrary javascript in product reviews, which may allow them to run stored XSS attacks against other users like site administrators.
Weakness: CWE-79
Which versions are affected by CVE-2022-3194?
It affects 1 product.
Products include Dokan Dokan.
How do I fix CVE-2022-3194?
No fix has been published for CVE-2022-3194 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2022-3194 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-3194 exists.
Other vulnerabilities in Unknown Dokan
- CVE-2024-3922 Dokan Pro <= 3.10.3 - Unauthenticated SQL Injection
- CVE-2022-3915 Dokan < 3.7.6 - Unauthenticated SQLi
- CVE-2023-26525 WordPress Dokan Plugin <= 3.7.12 is vulnerable to SQL Injection
- CVE-2023-34382 WordPress Dokan Plugin <= 3.7.19 is vulnerable to PHP Object Injection
- CVE-2020-36748 Dokan <= 3.0.8 - Cross-Site Request Forgery Bypass
Sources
Also known as GHSA-5g8x-4pjj-p6fm.