The vulnerability is an improper neutralization of input during web page generation, allowing reflected cross‑site scripting (XSS). An attacker can supply malicious script that the plugin reflects back to the victim’s browser; this flaw is classified as CWE‑79.

The issue affects the WordPress plugin My auctions allegro, Free Edition, developed by Wphocus. All releases from the initial version through 3.6.32 are vulnerable, so any WordPress site running a vulnerable instance of this plugin is at risk.

The CVSS score of 7.1 places the flaw in the high severity range, and the EPSS score of less than 1 % indicates a very low probability of exploitation at present. The vulnerability is not listed in CISA’s KEV catalog. While the CVE description does not specify an exploitation method, the typical attack vector for reflected XSS is a crafted request that injects payload into an unfiltered plugin output; the impact is confined to the user’s browser session, and additional damage scope is not detailed in the CVE data.