The vulnerability is an unauthenticated cross‑site scripting flaw that allows an attacker to inject malicious script into the content served by the Auction Nudge – Your eBay on Your Site plugin when the plugin version is 8.4.0 or earlier. If an attacker’s payload runs in a user’s browser it could steal session cookies, deface the site’s content, or redirect visitors to malicious sites. The flaw is identified as CWE‑79.

The affected component is the WordPress plugin Auction Nudge – Your eBay on Your Site from the vendor Morehawes. Any WordPress instance running version 8.4.0 or older of this plugin is vulnerable. All sites that rely on this plugin for eBay integration should review their versions.

The CVSS score of 7.1 indicates a high impact with a score closer to high severity. The EPSS score is not available, which does not confirm the prevalence of exploitation, but the fact that the flaw is unauthenticated suggests that it can be triggered by anyone who can inject a request to the site, making the attack vector remote. The vulnerability is not listed in CISA’s KEV catalog, indicating no confirmed, known exploitation in the wild as of the last rating. Admins should treat the risk as significant due to the potential for widespread script injection on any public-facing page served by the plugin.