The vulnerability is an improper neutralization of input during web page generation that leads to stored XSS in the Auction Feed plugin for WordPress. An attacker who can submit or edit content within the plugin can inject malicious script that will be executed in the browsers of other users who view that content. This can allow cookie theft, session hijacking, defacement, or other client-side compromises. The weakness is classified as CWE-79.

Affected systems include the WordPress Auction Feed plugin developed by morganrichards, specifically versions from the initial release through 1.1.4. Any WordPress site that has installed a vulnerable version of this plugin is at risk. The impact is limited to sites running these plugin versions.

The CVSS score of 7.1 places the issue in the high-severity range, but the EPSS score is below 1%, indicating a low probability that exploit code is actively in circulation. The vulnerability is not listed in the CISA KEV catalog. Exploitation would likely involve a user with permission to create or edit auction entries; the attacker would inject JavaScript that is stored and later rendered in the page. Administrators should treat this as a high-risk flaw when controlling access to the plugin’s input forms.