Cross-Site Scripting Flaw in My Auctions Allegro Plugin by WPHocus
CVE-2026-22491

7.1HIGH

Key Information:

Vendor

WordPress
Status
My Auctions Allegro
Vendor
CVE Published:
25 March 2026

What is CVE-2026-22491?

A Cross-Site Scripting (XSS) vulnerability exists in the My Auctions Allegro Plugin developed by WPHocus. This flaw allows attackers to inject malicious scripts into web pages that are generated by the affected plugin, leading to potential exploitation when users interact with those pages. The issue is present in My Auctions Allegro versions up to and including 3.6.35, making it essential for users to upgrade to secure their sites against reflected XSS attacks. Implementing proper input sanitation and validation mechanisms is critical to mitigating this vulnerability.

Affected Version(s)

My auctions allegro 0 <= 3.6.35

References

https://patchstack.com/database/Wordpress/Plugin/my-aucti...
vdb-entry

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

theviper17 | Patchstack Bug Bounty Program
.