Reflected XSS Vulnerability in WPHocus My Auctions Allegro Plugin
CVE-2025-22733

7.1HIGH

Key Information:

Vendor
WordPress
Status
My Auctions Allegro
Vendor
CVE Published:
21 January 2025

Summary

The WPHocus My Auctions Allegro plugin is susceptible to a reflected Cross-site Scripting (XSS) vulnerability. This weakness allows attackers to inject malicious scripts into web pages viewed by unsuspecting users, compromising their security and privacy. The vulnerability affects versions from n/a through 3.6.18, emphasizing the necessity for users to update to secure versions and implement best practices for WordPress security.

Affected Version(s)

My auctions allegro <= 3.6.18

References

https://patchstack.com/database/wordpress/plugin/my-aucti...
vdb-entry

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

João Pedro S Alcântara (Kinorth) (Patchstack Alliance)
.