Description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wphocus My auctions allegro my-auctions-allegro-free-edition allows Stored XSS.This issue affects My auctions allegro: from n/a through <= 3.6.35.
Published: 2025-12-24
Score: 5.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability permits stored cross‑site scripting by improperly neutralizing user input when generating web page content, allowing attackers to inject arbitrary JavaScript that can be executed by site visitors.

Affected Systems

Installations of the WordPress My auctions allegro free edition plugin version 3.6.35 or earlier, maintained by wphocus, are affected. The flaw can be triggered through any user‑submitted content processed by the plugin.

Risk and Exploitability

The CVSS score of 5.9 indicates moderate severity, while the EPSS score of < 1% shows a very low current likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector involves a form or interface that accepts user input processed by the plugin; this inference is drawn from the description that the issue is a stored XSS flaw.

Generated by OpenCVE AI on April 29, 2026 at 18:34 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update the My auctions allegro plugin to the latest available version that closes the stored XSS flaw.
  • If an immediate update is not possible, disable or restrict any plugin features that accept untrusted input, such as removing auction submission forms until the vulnerability is fixed.
  • Implement a content‑security policy or a web application firewall rule that blocks the execution of injected scripts to reduce the impact of any residual XSS payloads.

Generated by OpenCVE AI on April 29, 2026 at 18:34 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 23 Apr 2026 15:00:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 5.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N'}

 cvssV3_1

{'score': 5.9, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L'}

Wed, 01 Apr 2026 23:45:00 +0000

Type Values Removed Values Added
Description Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wphocus My auctions allegro my-auctions-allegro-free-edition allows Stored XSS.This issue affects My auctions allegro: from n/a through <= 3.6.32. Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wphocus My auctions allegro my-auctions-allegro-free-edition allows Stored XSS.This issue affects My auctions allegro: from n/a through <= 3.6.35.
Title WordPress My auctions allegro plugin <= 3.6.32 - Cross Site Scripting (XSS) vulnerability WordPress My auctions allegro plugin <= 3.6.35 - Cross Site Scripting (XSS) vulnerability

Tue, 20 Jan 2026 15:30:00 +0000

Type Values Removed Values Added
References

Tue, 20 Jan 2026 14:45:00 +0000

Type Values Removed Values Added
References

Mon, 29 Dec 2025 23:15:00 +0000

Type Values Removed Values Added
First Time appeared Wordpress
Wordpress wordpress
Wphocus
Wphocus my Auctions Allegro
Vendors & Products Wordpress
Wordpress wordpress
Wphocus
Wphocus my Auctions Allegro

Wed, 24 Dec 2025 20:15:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 5.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 24 Dec 2025 13:15:00 +0000

Type Values Removed Values Added
Description Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wphocus My auctions allegro my-auctions-allegro-free-edition allows Stored XSS.This issue affects My auctions allegro: from n/a through <= 3.6.32.
Title WordPress My auctions allegro plugin <= 3.6.32 - Cross Site Scripting (XSS) vulnerability
Weaknesses CWE-79
References

Subscriptions

Wordpress Wordpress
Wphocus My Auctions Allegro
cve-icon MITRE

Status: PUBLISHED

Assigner: Patchstack

Published:

Updated: 2026-04-28T16:14:30.498Z

Reserved: 2025-12-19T10:17:28.557Z

Link: CVE-2025-68566

cve-icon Vulnrichment

Updated: 2025-12-24T18:53:16.797Z

cve-icon NVD

Status : Deferred

Published: 2025-12-24T13:16:23.470

Modified: 2026-04-27T19:16:31.137

Link: CVE-2025-68566

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-29T18:45:17Z

Weaknesses