The vulnerability is an improper neutralization of user-supplied input during webpage rendering, which permits attackers to inject and execute arbitrary JavaScript code when a victim views a crafted page. This can lead to session hijacking, defacement, or data theft. The weakness is identified as CWE‑79.

The flaw affects the My auctions allegro plugin for WordPress, published by wphocus, versions up to and including 3.6.35. Any site running the plugin in that version range is potentially vulnerable.

The CVSS score is 7.1, indicating a high severity. No EPSS data is available, and the vulnerability is not in the CISA KEV catalog. Attackers can exploit this remotely by supplying malicious input to a reflected parameter in the plugin’s input forms or URLs; no credentials or local access are required. Given the broad exposure to web traffic, the likelihood of exploitation is significant for unpatched sites.