The vulnerability resides in the WP‑Lister Lite for eBay WordPress plugin and allows an attacker to store malicious JavaScript in the plugin’s AJAX cron handler. Once injected, the script is rendered on pages accessed by any user, potentially leading to session hijack, credential theft, defacement, or further exploitation of the hosting site. The weakness is a classic output‑encoding flaw, classified as CWE‑79. The attack is non‑privileged and does not require administrator access, making it broadly exploitable in environments where the plugin is installed.

All installations of WP‑Lister Lite for eBay version 3.8.9 or earlier are susceptible. The plugin is available for WordPress sites and does not limit the vulnerability to a particular host or customer type. The affected file is the AJAX cron handler, which is invoked by the plugin regardless of user role.

The CVSS score of 7.2 reflects a high impact, but the EPSS score of less than 1% indicates that, as of the latest data, the probability of seeing active exploitation in the wild is low. The vulnerability is not listed in CISA’s KEV catalog. Attackers can exploit the flaw simply by sending an unauthenticated AJAX request to the cron handler with crafted parameters; no additional privileges or pre‑conditions are required. Once the script is stored, any visitor to the affected page will execute it, providing a wide attack surface for phishing, cookie theft, or malware distribution.