Hackthesoul

**Name of the Vulnerable Software and Affected Versions** Dokan: AI Powered WooCommerce Multivendor Marketplace Solution versions prior to 5.0.5 **Description** Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Authenticated attackers with custom-level access or higher can inject arbitrary web scripts into pages. These scripts execute when a user accesses the affected page, as the store search widget inserts an unescaped AJAX response HTML into the Document Object Model (DOM) using the jQuery `.html()` method. The malicious payload is delivered to site visitors, including unauthenticated users, via the product SKU. **Recommendations** Update Dokan: AI Powered WooCommerce Multivendor Marketplace Solution to version 5.0.5 or later.