Unauthenticated Cross‑Site Scripting (XSS) is present in WooCommerce Simple Auctions plugin versions up to 3.0.10. An attacker can inject arbitrary JavaScript that will execute in the browsers of visitors who view affected auction pages. This weakness allows the attacker to steal session cookies, deface the site, or redirect users as described in the CVE description. The vulnerability is a classic input‑validation issue classified as CWE‑79.

The affected system is the WordPress plugin WooCommerce Simple Auctions delivered by wpgenie. All releases of the plugin with a version number of 3.0.10 or older are vulnerable. Users running those versions on public‑facing WordPress sites are at risk.

The CVSS score of 7.1 places this flaw in the high severity range. The EPSS score of 0.00251 indicates a very low probability of exploitation, but the flaw could still be used in targeted attacks. The vulnerability is not currently listed in the CISA KEV catalog. The likely attack vector is unauthenticated interaction with the site, such as visiting a malicious auction URL or submitting a crafted form; the attacker does not need prior authorization or privileged access to exploit it.